5.3Access control lists (ACLs)

An ACL is an ordered list of rules that a router/switch evaluates one line at a time to decide "which traffic to pass and which to stop." In practice you translate requirements like "block only a specific port to a specific server" or "cut only the traffic from one department to another" into judgments about standard versus extended, on which interface's in/out direction, and in what order to write the entries. Because a wrong order or placement can block unintended traffic, an accurate understanding of the mechanism is essential.

5.3.1Standard ACLs and extended ACLs

• A standard ACL permits/denies based on the source IP address only. Its number range is 1-99 (expanded range 1300-1999). Since the only criterion is the source, placing it near the source would drop "all traffic from that source to every destination" at once. Therefore the rule is to place it on an interface near the destination so it does not sweep up needed traffic.
• An extended ACL judges more finely, specifying the source IP, destination IP, protocol (TCP/UDP/ICMP, etc.), and port number. Its number range is 100-199 (expanded range 2000-2699). Because it can pinpoint exactly the intended traffic, the rule is to place it on an interface near the source to drop unwanted traffic early and avoid wasting bandwidth.
• A named ACL uses a meaningful name instead of a number (ip access-list standard NAME / ip access-list extended NAME). You still specify standard vs extended, but its advantage over numbered ACLs is that you can insert/delete lines by sequence number, giving high editability. Numbered vs named is merely a difference in identification; the filtering capability is determined by the standard/extended distinction.

5.3.2Implicit deny, wildcard mask, and processing order

• An ACL is evaluated top-down and finalized by the permit/deny of the first matching line (later lines are not evaluated). Every ACL ends with an unstated implicit deny (deny any), so if nothing matches, traffic is implicitly denied. Therefore at least one permit line is required, and the iron rule is to write more specific lines first and broader lines later.
• A wildcard mask is a 32-bit value that specifies an address range in an ACL; it is the bit-inverse of a subnet mask (0 = must match, 1 = don't care). For example, 0.0.0.255 means "match the first 24 bits, ignore the last 8 bits" = an entire /24. A single host is expressed with the host keyword (= 0.0.0.0), and all addresses with any (= 0.0.0.0 255.255.255.255).
• Apply to an interface with ip access-group NUMBER|NAME in|out (use access-class on VTY lines). in = traffic entering the router, out = traffic leaving the router; a wrong direction blocks the opposite of what you intend. Verify with show access-lists / show ip access-lists (to check hit counts), show running-config, and show ip interface (to see where it is applied).

Suppose you are a network administrator given the requirement: "Prohibit hosts in the development department (10.1.10.0/24) from reaching the accounting server's (10.1.99.5) web admin interface (TCP 443), but do not impede any of the development department's other traffic or access to other servers whatsoever." First, because you must specify source, destination, protocol, and port, a standard ACL that can only see the source cannot do this, so an extended ACL (100-199) is required. Order is everything: (1) access-list 110 deny tcp 10.1.10.0 0.0.0.255 host 10.1.99.5 eq 443 denies exactly the targeted traffic, and (2) access-list 110 permit ip any any permits all the rest. If you forget (2), the trailing implicit deny would block all of the development department's other legitimate traffic too, violating "do not impede the rest." Next, for placement, following the extended-ACL rule of applying it inbound on the router interface closest to the source (the development department) drops the unwanted traffic before hauling it all the way to the accounting server. Trying to substitute a standard ACL here fails: since it can only judge source 10.1.10.0/24, it would sweep up "all traffic from development to the accounting server" or "all traffic from development to any destination," failing the requirement. The crux of the judgment is these three points: "filtering by destination or port requires an extended ACL," "place an explicit permit last so you do not hit the implicit deny," and "extended ACLs go inbound near the source."

5.3.3Section summary

• A standard ACL (1-99) judges source only and goes near the destination; an extended ACL (100-199) judges source/destination/port and goes near the source
• An ACL is top-down, first-match-wins, and because of the trailing implicit deny, at least one permit is required. Ranges are specified with a wildcard mask (the bit-inverse of a subnet mask)
• Apply with ip access-group NUMBER|NAME in|out (access-class on VTY); verify with show access-lists / show ip access-lists / show ip interface