Access Control List (ACL) in Networking
Introduction
An Access Control List (ACL) is a set of rules used in networking
devices such as routers and switches to control network traffic.
ACLs decide:
• Which traffic is allowed
• Which traffic is blocked
ACLs improve:
• Security
• Traffic management
• Network performance
Definition
An ACL is a list of permit and deny statements applied to a router
interface.
It filters packets based on:
• Source IP address
• Destination IP address
• Protocol type
• Port numbers
Why ACLs are Used
ACLs are used for:
1. Security
Prevent unauthorized users from accessing the network.
2. Traffic Filtering
Allow or block specific types of traffic.
3. Network Management
Control bandwidth and traffic flow.
4. Restrict Services
Block services like FTP, Telnet, or HTTP.
How ACL Works
When a packet enters or leaves a router:
1. Router checks ACL rules one by one.
2. If packet matches a rule:
o Action is performed (permit or deny)
3. If no rule matches:
o Packet is automatically denied.
This is called:
Implicit Deny
At the end of every ACL there is an invisible rule:
deny any
Types of ACL
There are two main types:
Type Filters Based On
Standard ACL Source IP address
Extended ACL Source, destination, protocol, ports
1. Standard ACL
Features
• Uses only source IP address
• Simpler
• Less control
Number Range
1 – 99
Example
access-list 10 deny [Link] [Link]
access-list 10 permit any
Explanation
• Denies network [Link]
• Allows all other traffic
2. Extended ACL
Features
• More advanced
• Can filter:
o Source IP
o Destination IP
o Protocols
o Port numbers
Number Range
100 – 199
Example
access-list 101 permit tcp [Link] [Link] any eq 80
Explanation
• Permits HTTP traffic
• From network [Link]
• To any destination
ACL Directions
ACL can be applied in two directions:
Direction Meaning
Inbound Traffic entering interface
Outbound Traffic leaving interface
Applying ACL to Interface
Example:
Router(config)# interface gig0/0
Router(config-if)# ip access-group 10 in
Meaning
• Apply ACL 10
• On interface gig0/0
• In inbound direction
Wildcard Mask in ACL
ACLs use wildcard masks instead of subnet masks.
Rule
• 0 = Match
• 1 = Ignore
Example
[Link]
Means:
• First 3 octets must match
• Last octet can be anything
Common ACL Keywords
Keyword Meaning
permit Allow traffic
deny Block traffic
any Any address
host Single host
Example Using Host
access-list 15 permit host [Link]
Allows only one device.
Placement of ACLs
ACL Type Placement
Standard ACL Near destination
Extended ACL Near source
Advantages of ACL
• Improves security
• Reduces unwanted traffic
• Controls access
• Better network performance
Disadvantages of ACL
• Difficult in large networks
• Wrong rule may block valid traffic
• Requires proper planning
Real-Life Example
Scenario
A company wants:
• Office PCs can browse websites
• Guest users cannot access servers
ACL can:
• Permit HTTP/HTTPS traffic
• Deny server access for guests
Basic Cisco ACL Commands
Create Standard ACL
access-list 1 permit [Link] [Link]
Create Extended ACL
access-list 100 deny tcp any any eq 23
(Blocks Telnet)
Verifying ACL
Show ACL
show access-lists
Show Interface ACL
show ip interface
Important Points
• ACL rules are checked top to bottom.
• First match is applied.
• ACL ends with implicit deny.
• Order of rules is very important.