5.2Protecting infrastructure with ACLs

An ACL is both a filter and a language for expressing match conditions: it is reused throughout ENCOR for QoS classification, selecting PBR traffic, selecting NAT traffic, restricting management access via access-class, and defining CoPP classes in the next section. That is exactly why you must internalize how it is evaluated—sequentially, decided by the first match, with an implicit deny at the end. What ENCOR asks is not the definition of standard versus extended but the diagnosis of "what breaks when this ACL is applied in this direction" and "why did intended traffic stop too."

5.2.1Standard and extended ACLs

• A standard ACL (numbers 1-99 and 1300-1999, or a named ip access-list standard) matches only the source IP address. Because it cannot see destinations or ports, it cannot block access to just one server. Its coarse granularity means that applying it near the source takes down needed traffic as collateral, so it is traditionally placed closer to the destination.
• An extended ACL (numbers 100-199 and 2000-2699, or ip access-list extended) can match on protocol, source IP, destination IP, and source/destination ports. Since it expresses intent precisely—for example permit tcp 10.1.1.0 0.0.0.255 host 10.9.9.10 eq 443—the rule of thumb is to place it close to the source so unwanted traffic is dropped early, saving needless bandwidth.
• Masks are written as wildcard masks (0 = must match, 1 = don't care), the inverse of a subnet mask; 10.1.1.0 0.0.0.255 corresponds to a /24. A single host is host 10.1.1.5 and everything is any. Getting the inversion backwards matches a wider or narrower range than intended.