LogoفارسیFA

Hands-On Lab: Configuring Named ACLs

This hands-on lab configures a named extended ACL, demonstrating how a descriptive name replaces a numeric identifier and how individual entries can be edited by sequence number without recreating the entire list.

Named ACL ConfigurationSequence Number EditingACL Readability

~3 min read · Updated Sep 23, 2026

Lab Objective

Configure a named extended ACL, verify it functions identically to a numbered ACL, and edit a single entry using its sequence number without removing and reapplying the entire list.

Lab Purpose

Named ACLs, discussed earlier in this series, are generally preferred over numbered ACLs in modern configurations because the name documents the ACL's purpose directly, and individual entries can be inserted, removed, or edited by sequence number, avoiding the need to delete and rebuild the entire list for a small change.

Lab Topology

R1
  Gi0/0: 192.168.35.1/24 (internal LAN)
  Gi0/1: 203.0.113.5/30 (WAN, toward internet)

Task 1: Configure Basic Addressing

Configure both interfaces as shown.

Task 2: Create a Named Extended ACL

Create a named ACL called WEB-ONLY, permitting HTTP and HTTPS traffic from the internal LAN, with an explicit deny for everything else.

Task 3: Apply the ACL

Apply WEB-ONLY inbound on Gi0/0.

Task 4: Verify the Sequence Numbers

Display the ACL and note the automatically assigned sequence numbers for each entry.

Task 5: Insert a New Entry Using a Specific Sequence Number

Insert a new permit statement for DNS traffic (port 53) between the two existing entries, using a sequence number that places it correctly, without deleting and recreating the ACL.

Solution and Verification

R1(config)# interface gigabitethernet0/0
R1(config-if)# ip address 192.168.35.1 255.255.255.0
R1(config-if)# no shutdown
R1(config-if)# exit
R1(config)# interface gigabitethernet0/1
R1(config-if)# ip address 203.0.113.5 255.255.255.252
R1(config-if)# no shutdown

R1(config)# ip access-list extended WEB-ONLY
R1(config-ext-nacl)# permit tcp 192.168.35.0 0.0.0.255 any eq 80
R1(config-ext-nacl)# permit tcp 192.168.35.0 0.0.0.255 any eq 443
R1(config-ext-nacl)# deny ip any any

R1(config)# interface gigabitethernet0/0
R1(config-if)# ip access-group WEB-ONLY in

R1# show ip access-lists WEB-ONLY

Extended IP access list WEB-ONLY
    10 permit tcp 192.168.35.0 0.0.0.255 any eq www
    20 permit tcp 192.168.35.0 0.0.0.255 any eq 443
    30 deny ip any any
-- IOS automatically assigned sequence numbers
-- in increments of 10, leaving room to
-- insert new entries between existing ones

R1(config)# ip access-list extended WEB-ONLY
R1(config-ext-nacl)# 15 permit udp 192.168.35.0 0.0.0.255 any eq 53

-- Using sequence number 15 places this new
-- entry precisely between the existing 10
-- and 20, without touching either of them
-- or the deny statement at 30

R1# show ip access-lists WEB-ONLY

Extended IP access list WEB-ONLY
    10 permit tcp 192.168.35.0 0.0.0.255 any eq www
    15 permit udp 192.168.35.0 0.0.0.255 any eq 53
    20 permit tcp 192.168.35.0 0.0.0.255 any eq 443
    30 deny ip any any

Key Takeaway

The gap left between automatically assigned sequence numbers (typically increments of 10) exists specifically to allow inserting new entries later without renumbering or recreating the entire ACL — this is a significant practical advantage over the numbered ACL syntax used in earlier labs, which requires removing and re-adding the complete list to make even a single small change.

Written & researched by Dr. Shahin Siami

Related Articles

Hands-On Lab: Configuring OSPF Virtual Links

This hands-on lab connects a disconnected area to the backbone using an OSPF virtual link, addressing a design violation where an area does not have a direct physical connection to Area 0, and verifies routes flow correctly once the virtual link is established.

Continue

Hands-On Lab: Configuring an OSPF NSSA Area

This hands-on lab configures Area 1 as an NSSA, redistributing a local external route directly from within that area and verifying it propagates as a Type 7 LSA before being translated to Type 5 at the ABR, while inter-area routes from elsewhere remain blocked exactly as in a standard stub area.

Continue

Hands-On Lab: Configuring OSPF Stub and Totally Stubby Areas

This hands-on lab configures a leaf area as a standard stub area, then upgrades it to a totally stubby area, comparing the routing table size at each stage and verifying only a default route remains once fully configured.

Continue

Hands-On Lab: Configuring Multi-Area OSPF with Route Summarization

This hands-on lab configures multi-area OSPF across three routers, designating an ABR that summarizes several subnets from a leaf area into a single route advertised toward the backbone, tying together the area design and summarization concepts covered earlier in this series.

Continue

Hands-On Lab: Configuring EIGRP for IPv6

This hands-on lab configures EIGRP for IPv6 between two routers, activating the protocol directly on each interface similar to OSPFv3's approach, and highlights the mandatory router ID requirement unique to EIGRPv6.

Continue

Hands-On Lab: Configuring OSPFv3 for IPv6

This hands-on lab configures OSPFv3 between two routers to dynamically route IPv6 traffic, comparing its configuration syntax against the OSPFv2 labs covered earlier in this series while highlighting the interface-level activation approach OSPFv3 uses.

Continue
Previous ArticleNext Article