Access control lists (ACLs)

What an ACL does

An access control list (ACL) is a list of rules, each saying permit or deny for a kind of traffic. Applied to an interface, it filters packets: the router checks each packet against the list and forwards or drops it. ACLs are also used just to match traffic for other features, for example to say which addresses NAT should translate or which traffic QoS should prioritise. In that case "permit" means "this traffic is selected", not "this traffic passes".

Standard and extended ACLs

Named ACLs use a name instead of a number, such as GUEST-IN. They work the same way but are easier to read and easier to edit. Most engineers use named ACLs today.

Wildcard masks, host and any

ACLs use a wildcard mask instead of a subnet mask. In a wildcard mask, a 0 bit means "this bit must match" and a 1 bit means "ignore this bit". So it is the inverse of the subnet mask: subtract each octet of the mask from 255. For 255.255.255.0 the wildcard is 0.0.0.255, so 192.168.10.0 0.0.0.255 matches every address from 192.168.10.0 to 192.168.10.255.

• host 10.0.0.5 is short for 10.0.0.5 0.0.0.0: exactly one address.
• any is short for 0.0.0.0 255.255.255.255: every address.
• For a /26 (255.255.255.192) the wildcard is 0.0.0.63.

How the router reads an ACL

1. Rules are checked top-down, in order of sequence number.
2. The first rule that matches decides: permit or deny. The rest are not checked.
3. If no rule matches, the packet hits the implicit "deny any" at the end, which you never see in the configuration.

Writing and applying ACLs

! Standard named ACL: only the IT subnet may reach the server LAN
R1(config)# ip access-list standard IT-ONLY
R1(config-std-nacl)# permit 192.168.50.0 0.0.0.255
R1(config-std-nacl)# exit
R1(config)# interface gigabitEthernet0/2
R1(config-if)# ip access-group IT-ONLY out

ip access-group NAME in checks packets as they arrive on the interface; out checks them as they leave. You can have only one ACL per interface, per direction, per protocol: one IPv4 inbound, one IPv4 outbound (and IPv6 has its own). Applying a second ACL in the same direction replaces the first.

Worked example: guests must not reach finance

An office has a guest VLAN 30 (192.168.30.0/24) and a finance server at 10.10.10.20. Guests should use the internet but never reach the finance server. An extended ACL can match the destination, so we place it close to the source: inbound on the guest VLAN gateway interface.

R1(config)# ip access-list extended GUEST-IN
R1(config-ext-nacl)# 10 deny ip 192.168.30.0 0.0.0.255 host 10.10.10.20
R1(config-ext-nacl)# 20 deny ip 192.168.30.0 0.0.0.255 10.0.0.0 0.255.255.255
R1(config-ext-nacl)# 30 permit udp 192.168.30.0 0.0.0.255 any eq 53
R1(config-ext-nacl)# 40 permit tcp 192.168.30.0 0.0.0.255 any eq 443
R1(config-ext-nacl)# 50 permit tcp 192.168.30.0 0.0.0.255 any eq 80
R1(config-ext-nacl)# exit
R1(config)# interface gigabitEthernet0/1.30
R1(config-subif)# ip access-group GUEST-IN in

Why not use a standard ACL? It can only look at the source. Placed near the guests, it would block guests from everything, including the internet. That is why standard ACLs go close to the destination and extended ones close to the source: extended ACLs can be precise, so they drop unwanted traffic early before it crosses the network.

Editing and checking

Named ACL rules have sequence numbers (10, 20, 30 by default). To insert a rule between 10 and 20, enter the ACL and type 15 followed by the rule. To remove one, type no 20. show access-lists lists every rule with a hit counter, such as "(42 matches)", which shows which rules are really used. clear access-list counters resets them.

R1# show access-lists GUEST-IN
Extended IP access list GUEST-IN
    10 deny ip 192.168.30.0 0.0.0.255 host 10.10.10.20 (12 matches)
    20 deny ip 192.168.30.0 0.0.0.255 10.0.0.0 0.255.255.255 (3 matches)
    30 permit udp 192.168.30.0 0.0.0.255 any eq domain (880 matches)
    40 permit tcp 192.168.30.0 0.0.0.255 any eq 443 (5120 matches)
    50 permit tcp 192.168.30.0 0.0.0.255 any eq www (97 matches)

Common mistakes

• A broad rule above a specific one: "permit ip any any" at line 10 makes every later deny useless. Put specific rules first.
• Wrong direction: an inbound ACL applied out (or the reverse) matches the wrong traffic. Picture the packet arriving at or leaving the router.
• Using a subnet mask instead of a wildcard: 192.168.10.0 255.255.255.0 means something very different. Write 0.0.0.255.
• Forgetting the implicit deny, and blocking DNS so "the internet is down" even though web traffic is permitted.