So…Why Are Access Lists Important?
An ACL is literally just a list of statements.
There are two major types; standard and extended.
Standard is just a list of source ip addresses with a permit or deny statement.
Extended ACLs you can deny or permit with the protocols, or with the TCP protocol numbers.
Five Most Common ACL Purposes
Traffic filtering (Extended ACL)
“I want to permit inbound ACL#3 on that Ethernet 0/1 interface.”
So, each time the computer sends a request to the router, the router goes “are you 10.1.5.9, because I got an ACL applied that 10.1.5.9 is permitted”.
ACLs get worked through from the top to the bottom, like firewall rules, and stops whenever it reaches the first match. And if you’re NOT matched, you are getting denied.
NAT (Standard ACL)
We did this in advance. We said in the NAT rule “ip nat inside source list 1 interface XY”
So we said we want to nat from the inside out of this interface XY, and we want to NAT all what’s in the ACL #1. So if you are NOT in the ACL #1, what will not work? The ip will not get NATed.
Route filtering (Standard ACL)
Route filtering allows you (with a standard ACL) to say “hey, look, I know we formed a relationship, but this and this network you don’t have to know about.”
QoS (Extended ACL)
It’s kind of a good discrimination 😉
Match the range of IP addresses which for example, match the IP phones, and permit the IP phones to have priority, so the phone call does not get disturbed / interrupted.
Security (Standard ACL)
You could restrict the SSH access to all of your routers or switches to a group of IP addresses.
Like line vty 0 4
Access-class 50 in
This allows only the Ips in that ACL to allow to access the switch or router via telnet or SSH.
Standard ACL Configuration
In / out -> BE THE ROUTER
STD ACL apply it as close to the destination as possible.
Extended ACL Configuration
| 3 major pieces | ||
| Protocol | Source | Destination |
| TCP (#1) | ||
| UDP (#2) | ||
| ICMP (#3) | What sort of ICMP traffic do you want to permit / deny? | |
| IP (any internet protocol) | ||
With extended access-lists it is the other way around. You want to place the EXT ACL as close as possible to the SOURCE.
| Protocols you should know | |
| Protocol | Port |
| HTTP | TCP-80 |
| HTTPS | TCP-443 |
| FTP | TCP-21 |
| TELNET | TCP-23 |
| SSH | TCP-22 |
| POP3 | TCP-110 |
| SMTP | TCP-25 |
| IMAP | TCP-153 |
| DNS | UDP-53 |
Cisco IOS commands learned in this lesson
| Command | Explanation |
| access-class 50 in | Applies a standard access list (ACL 50) to filter incoming Telnet/SSH management connections. |
| ip nat inside source list 1 interface <interface> | Links Standard ACL 1 to Dynamic NAT/PAT, defining which source IP addresses are allowed to be translated when exiting the specified interface. |
| access-list <1-99> {permit | deny} <source-ip> [wildcard-mask] | Configures a numbered Standard IPv4 Access List filtering strictly by source address (e.g., used for NAT, VTY line security, or route filtering). |
| ip access-list standard <name-or-number> | Opens Named/Modern Standard ACL configuration mode |
| access-list <100-199> {permit | deny} <protocol> <source> <destination> [port-operator] | Configures a numbered Extended IPv4 Access List matching protocol (TCP, UDP, ICMP, IP), source, destination, and port numbers (e.g., TCP 80 for HTTP, TCP 22 for SSH, UDP 53 for DNS). |
| ip access-list extended <name-or-number> | Opens Named Extended ACL configuration mode |
| ip access-group <acl-number|name> {in | out} | Applies a Standard or Extended ACL to an interface for inbound or outbound traffic filtering. |
| show ip access-lists | Displays all configured ACLs along with packet match counters/hit counts. |
| show ip interface <interface> | Shows interface details, including whether inbound or outbound ACLs are applied (Inbound access list is… / Outbound access list is…). |
| class-map [match-all | match-any] <class-name> & match access-group <acl-number> | QoS Configuration. Matches traffic based on an Extended ACL to prioritize voice or critical data. |
| distribute-list <acl-number> {in | out} [interface] | Uses a Standard ACL to perform route filtering within dynamic routing protocols (e.g., OSPF, EIGRP). |