Standard ACLs

A real-life situation

A small company has two user LANs on router R1: the Sales LAN and the Admin LAN. Behind R2 sits the server LAN, with a file server that holds payroll data. A new rule arrives from management: "Sales must not reach the server LAN. Admin can." Routing works perfectly, which is exactly the problem: every network can reach every other network.

You don't need a firewall for a rule this simple. A router can check each packet against a list of rules and drop the ones you don't want. That list is an access control list (ACL).

What an ACL is

An ACL is an ordered list of permit and deny statements. Each statement is called an access control entry (ACE). On its own an ACL does nothing. It only filters traffic once you apply it to an interface in one direction: in (packets arriving on the interface) or out (packets leaving it).

A standard ACL is the simplest kind. It can only look at one thing: the packet's source IPv4 address. It can't see the destination, the protocol or the port. When you need those, you use an extended ACL. If the idea of filtering traffic by rules is new to you, read Firewall basics first.

Why it works that way

ACLs were designed to be fast. A router may check millions of packets a second, so the rules are simple and the order is fixed. Four rules explain almost everything an ACL does:

• Top-down, first match wins. The router compares the packet with each entry in order. At the first entry that matches, it permits or denies the packet and stops looking. Later entries are never checked for that packet.
• Implicit deny at the end. Every ACL ends with an invisible deny any. A packet that matches nothing is dropped. So an ACL with only deny entries blocks everything.
• One ACL per interface, per direction, per protocol. Gi0/0 can have one IPv4 ACL inbound and one IPv4 ACL outbound. Applying a second one in the same direction replaces the first.
• Standard ACLs go close to the destination. Because a standard ACL only knows the source, placing it near the source would block that source from going anywhere through that interface. Near the destination, it only affects traffic to that destination.

In the lab, a standard ACL on R1 Gi0/0 inbound denying Sales would cut Sales off from the Admin LAN and from every other network too. On R2 Gi0/0 outbound, it only stops Sales reaching the servers, which is the rule you were given.

Wildcard masks, step by step

An ACL entry describes a group of addresses with an address and a wildcard mask. The wildcard tells the router which bits of the address to check. Read each bit of the wildcard like this:

• 0 = this bit must match the address in the entry.
• 1 = ignore this bit; it can be anything.

That is the reverse of a subnet mask, which you met in Subnet mask basics. For any normal subnet, there is a quick way to get the wildcard:

Two wildcards are so common that IOS has keywords for them:

• host 192.168.20.10 is the same as 192.168.20.10 0.0.0.0: check every bit, so exactly one address.
• any is the same as 0.0.0.0 255.255.255.255: check no bits, so every address.

Try some entries below. Pick a preset or type your own, then test an address against it. The last preset shows something a subnet mask can't do: a wildcard whose 1 bits are not all at the end. IOS accepts it, but you will rarely need it.

To convert quickly in either direction, use the Wildcard Mask Calculator.

How it works step by step

Where does the ACL check happen in the router's work? An inbound ACL runs before the routing decision. An outbound ACL runs after the router has chosen the exit interface.

Now follow two packets through ACL 10 on R2 Gi0/0 outbound. The list has two entries:

1. PC1 (192.168.10.10) sends a packet to SRV1. R2 compares the source with entry 10: the first three octets must equal 192.168.10, and they do. The entry says deny, so R2 drops the packet and sends an ICMP "administratively prohibited" message back to PC1. Entry 20 is never checked.
2. The Admin PC (192.168.20.10) sends a packet to SRV1. Entry 10 does not match (the third octet is 20, not 10). Entry 20, permit any, matches everything, so the packet is sent.
3. If entry 20 were missing, the Admin packet would reach the implicit deny and be dropped too. A list of only deny entries blocks everything.

How to configure it on Cisco IOS

⚠️ Based on Cisco IOS / IOS XE documentation, not run on a lab device.

There are two steps: create the list in global configuration mode, then apply it to an interface with ip access-group.

A numbered standard ACL

The same rule as a named ACL

A named ACL does the same job but has a name you choose. You enter a sub-mode for the list and type the entries without repeating the list name each time.

Limiting who can log in to the router

Standard ACLs have a second common job: controlling which addresses can open a Telnet or SSH session to the router itself. Here you use access-class on the VTY lines instead of ip access-group on an interface. Logins themselves are covered in Passwords, local users and SSH.

A full example

How to verify it

R2#show access-lists
Standard IP access list PROTECT-SERVERS
    10 deny   192.168.10.0, wildcard bits 0.0.0.255 (12 matches)
    20 permit any (348 matches)

R2#show ip interface GigabitEthernet0/0
GigabitEthernet0/0 is up, line protocol is up
  Internet address is 192.168.30.1/24
  Broadcast address is 255.255.255.255
  ...
  Outgoing access list is PROTECT-SERVERS
  Inbound  access list is not set
  ...

What goes wrong and how to troubleshoot it

A good habit: before you apply an ACL to a remote router, make sure you won't block your own session. If you manage R2 from the Admin LAN, an inbound ACL on R2 Gi0/1 with no permit for your address cuts you off immediately.

Common mistakes

• Typing a subnet mask instead of a wildcard. deny 192.168.10.0 255.255.255.0 is accepted, but it checks only the last octet: it matches any address ending in .0.
• Forgetting the implicit deny. A list with only deny lines blocks every packet.
• Wrong order. permit any as the first entry makes every later entry useless.
• Deleting a whole numbered ACL by accident. In the old global syntax, no access-list 10 deny 192.168.10.0 0.0.0.255 removes all of list 10, not just that line. Edit with sequence numbers instead (shown in Extended and named ACLs).
• Using ip access-group on VTY lines (it's access-class there), or access-class on an interface.

💡 Exam tip: expect to calculate wildcard masks (for example, which entry matches hosts 172.16.4.0 to 172.16.7.255: 172.16.4.0 0.0.3.255), to spot that a list blocks everything because of the implicit deny, and to choose placement: standard close to the destination. Know the number ranges (1-99, 1300-1999), the host and any keywords, and that access-class is for VTY lines while ip access-group is for interfaces.

Key takeaways

• A standard ACL matches only the source IPv4 address.
• Entries are checked top-down; the first match wins.
• Every ACL ends with an invisible deny any.
• Wildcard 0 = must match, 1 = ignore. For a subnet, 255 minus each mask octet.
• Place standard ACLs close to the destination.
• Apply with ip access-group on interfaces and access-class on VTY lines.

Check yourself