Advanced Access Control Lists (ACL) Implementation Guide

Access Control Lists (ACLs) are the backbone of network security, controlling which packets are permitted or denied across interfaces. This guide dives deep into ACL types, standard vs extended, numbered vs named ACLs, and real-world deployment strategies for CCNA, CCNP, and enterprise networks.

Standard ACL Implementation for Cisco Devices

Standard ACLs filter traffic solely based on the source IP address. These ACLs are highly efficient but provide minimal granularity. They are best for simple access policies such as blocking specific subnets.

Numbered Standard ACLs

Numbered ACLs use a numerical identifier for quick deployment:

• Number Range: 1–99 (IPv4)

# Example: Permit traffic from 192.168.1.0/24 subnet
R(config)# access-list 10 permit 192.168.1.0 0.0.0.255
R(config)# access-list 10 deny any ; Implicit deny

Named Standard ACLs

Named ACLs provide descriptive identifiers, improving management in large networks:

# Create a named standard ACL
R(config)# ip access-list standard BLOCK_GUEST_NET
R(config-std-nacl)# deny 10.10.0.0 0.0.255.255
R(config-std-nacl)# permit any

Extended ACLs for Granular Traffic Control

Extended ACLs allow precise control over network traffic by filtering on source/destination IPs, protocols (TCP/UDP/ICMP), and ports. They are essential for enforcing enterprise security policies.

Numbered Extended ACLs

• Number Range: 100–199 (IPv4)

# Permit HTTP to server and block ICMP from a subnet
R(config)# access-list 110 permit tcp any host 10.0.0.50 eq 80
R(config)# access-list 110 deny icmp 192.168.5.0 0.0.0.255 any echo

Named Extended ACLs

Named extended ACLs are recommended for complex policies:

# Corporate security policy example
R(config)# ip access-list extended CORP_POLICY
R(config-ext-nacl)# deny tcp any any eq telnet ; port 23
R(config-ext-nacl)# permit tcp any any eq ssh
R(config-ext-nacl)# permit tcp any any eq www
R(config-ext-nacl)# permit tcp any any eq 443
R(config-ext-nacl)# permit udp any any eq domain
R(config-ext-nacl)# permit tcp any any eq ftp

Applying ACLs to Cisco Interfaces

ACLs must be applied to interfaces to take effect. You can attach a single ACL per direction (inbound or outbound).

• in: Filters traffic entering the interface
• out: Filters traffic exiting the interface

# Apply named ACL to outbound traffic
R(config)# interface GigabitEthernet0/1
R(config-if)# ip access-group CORP_POLICY out

Explore Related ACL Topics

Boost your understanding of Cisco ACLs by exploring our internal cluster articles. Each guide links back to this pillar for maximum crawlability:

• Advanced Extended ACL Configuration for Cisco Routers
• ACL Best Practices in Enterprise Networks
• Named vs Numbered ACLs Explained
• ACL Troubleshooting and Debug Techniques

Quick ACL Snippet for CCNA Exam Prep

# Permit HTTP & HTTPS, deny Telnet
R(config)# ip access-list extended EXAM_SNIPPET
R(config-ext-nacl)# permit tcp any any eq 80
R(config-ext-nacl)# permit tcp any any eq 443
R(config-ext-nacl)# deny tcp any any eq telnet