1 Access Control Lists
Learn how IPv4 access control lists match and filter packets, how to apply them to interfaces, and how to verify their effects.
How ACLs make decisions
An is an ordered set of rules that a router or Layer 3 switch checks to decide whether to permit or deny packets. The ACL has no effect until it is applied to an interface or another feature that uses ACLs. The examples use Cisco IOS-style commands; available syntax can vary by platform and software version.
Choose an ACL type
A matches only the packet’s source IPv4 address. Use it when the decision depends on who sent the traffic, such as allowing a particular subnet to reach a service.
An can match the protocol, source and destination addresses, and, for TCP or UDP, port numbers. Use it when the decision depends on what traffic is going where, such as allowing HTTP from one subnet to one server. Named ACLs are easier to identify and edit; numbered ACLs are also supported.
Read wildcard masks
A is an inverse mask: zero bits must match the corresponding address bits, while one bits can vary. For example, 0.0.0.255 matches addresses whose first three octets match the specified address. To calculate a wildcard from a subnet mask, subtract the subnet mask from 255.255.255.255.
Common forms include:
host 192.0.2.25matches one address; equivalently, use192.0.2.25 0.0.0.0.anymatches any address; equivalently, use0.0.0.0 255.255.255.255.192.0.2.0 0.0.0.255matches addresses in that/24-sized range.
A wildcard is not always required for a single host: IOS generally treats an omitted wildcard as 0.0.0.0.
Order rules and account for
means the device checks entries from top to bottom and stops at the first match. If no entry matches, the at the end of the ACL denies the packet. Put specific exceptions before broader rules, and include the permits needed for all traffic that should remain allowed.
This permits HTTPS to one server from a client subnet, denies other traffic to that server, and permits other IP traffic:
The final permit preserves other IP traffic; without it, the would block traffic that did not match an earlier permit. The HTTPS permit appears before the deny so those permitted packets are not blocked first.
Apply ACLs in the packet path
Apply an ACL to an interface and select a direction. Inbound (in) checks packets as they arrive on the interface, before the routing decision. Outbound (out) checks packets as they leave the interface, after the routing decision.
A common design guideline is to place extended ACLs near the source, stopping unwanted traffic before it crosses the network. Standard ACLs are commonly placed near the destination because they cannot distinguish destinations. These are guidelines, not substitutes for checking the topology and policy: applying an ACL in the wrong direction or on the wrong interface can block intended traffic. Define and review an ACL before applying it, especially on a remote-access path.
Configure standard and extended ACLs
This permits hosts from 192.0.2.0/24 and denies other sources on the selected interface because it has no final permit:
Consider what other traffic the interface must carry before applying this policy.
This permits HTTP and HTTPS from 192.0.2.0/24 to server 198.51.100.20, denies other IP traffic to that server, and permits other IP traffic:
In an extended TCP rule, eq 80 or eq 443 matches the destination port because it follows the destination address. Confirm that the selected interface and direction match the actual path taken by the packets.
Verify and troubleshoot
Use these commands to inspect ACL rules, interface application, and the running configuration:
Check that the ACL contains the intended entries in the intended order, is attached to the correct interface and direction, and has match counters that change when you test traffic. Test both permitted and denied cases, such as HTTPS from an allowed client, HTTP from that client, and a connection to the server from a disallowed source.
If matching counters do not change, traffic may be taking another route, the test may not match the rule, or the ACL may be attached at the wrong point. The show ip access-lists command displays ACLs and counters.