Access Control Lists: Filtering Traffic on Cisco Routers

What an Access Control List Actually Does

An Access Control List (ACL) is an ordered list of rules that a router or switch evaluates against traffic passing through it, permitting or denying that traffic based on criteria such as source address, destination address, protocol, or port number. ACLs serve two major purposes: basic traffic security (blocking unwanted traffic) and traffic identification for other features, such as identifying which traffic should receive special handling in QoS or NAT policies covered later in this series.

How ACLs Process Traffic: Top-Down, First Match Wins

Every ACL evaluates its rules, called Access Control Entries (ACEs), in the exact order they were configured, from top to bottom, and stops as soon as it finds the first matching entry — the rest of the list is never consulted for that particular packet.

Example ACL processing order:
access-list 10 permit 192.168.1.10
access-list 10 deny 192.168.1.0 0.0.0.255
access-list 10 permit any

A packet from 192.168.1.10 matches line 1 and is
permitted — lines 2 and 3 are never even checked
for this specific packet

A packet from 192.168.1.50 does not match line 1,
matches line 2 (deny), and is dropped — line 3
is never checked for this packet

This top-down, first-match behavior explains why ACE ordering is critical: placing a broad deny statement before a more specific permit statement that should have matched first will silently block traffic that was actually intended to be allowed.

The Implicit Deny: A Critical Hidden Rule

Every ACL ends with an invisible, unconfigurable Implicit Deny — if a packet does not match any explicitly configured line, it is dropped by default.

access-list 10 permit 192.168.1.0 0.0.0.255
-- (implicit deny any, not visible in the
--  configuration, but always present)

A packet from 10.0.0.5 does not match the single
configured line and is silently dropped, due to
the implicit deny at the end of every ACL

This implicit deny is one of the most common sources of unexpected connectivity loss after applying a new ACL — an administrator who intends only to block one specific type of traffic must explicitly permit everything else, since anything not explicitly permitted is dropped by default.

Standard ACLs: Filtering by Source Address Only

A Standard ACL can filter based only on source IP address, making it simple but limited in precision.

Router(config)# access-list 10 permit 192.168.1.0 0.0.0.255
Router(config)# access-list 10 deny any

Router(config)# interface gigabitethernet 0/1
Router(config-if)# ip access-group 10 out

Standard ACLs are numbered 1-99 (and 1300-1999 for an expanded range) and, because they can only match on source address, should be applied as close to the destination as possible — applying one too close to the source risks unintentionally blocking traffic that was actually destined elsewhere.

Understanding the Wildcard Mask

ACLs use a Wildcard Mask rather than a standard subnet mask to specify which address bits must match exactly and which can be anything — conceptually the inverse of a subnet mask.

Subnet mask 255.255.255.0 means: match exactly
Wildcard mask 0.0.0.255 means: the equivalent
  range, but expressed as "don't care" bits

Converting a subnet mask to a wildcard mask:
255.255.255.0  → subtract each octet from 255
0.0.0.255      → wildcard mask

Wildcard for matching a single host:
0.0.0.0  (every bit must match exactly)

Wildcard for matching absolutely any address:
255.255.255.255  (every bit is "don't care")
-- commonly abbreviated with the keyword "any"

A 0 bit in the wildcard mask means that bit position must match exactly, while a 1 bit means that position can be anything — this inverted logic compared to a subnet mask is a common source of confusion for those learning ACLs for the first time.

Extended ACLs: Filtering by Source, Destination, Protocol, and Port

An Extended ACL can match on source address, destination address, protocol (TCP, UDP, ICMP), and port number, allowing far more precise filtering.

Router(config)# access-list 100 permit tcp 192.168.1.0 0.0.0.255 any eq 80
Router(config)# access-list 100 permit tcp 192.168.1.0 0.0.0.255 any eq 443
Router(config)# access-list 100 deny ip any any

Router(config)# interface gigabitethernet 0/0
Router(config-if)# ip access-group 100 in

This extended ACL permits only HTTP (port 80) and HTTPS (port 443) traffic from the 192.168.1.0/24 network to any destination, denying everything else — the kind of granular control impossible with a standard ACL. Extended ACLs, numbered 100-199 (and 2000-2699 for an expanded range), should be applied as close to the source as possible, since they can already match on the specific destination and do not risk unintentionally filtering unrelated traffic the way an early-placed standard ACL could.

Named ACLs: A More Manageable Alternative

Router(config)# ip access-list extended WEB-TRAFFIC
Router(config-ext-nacl)# permit tcp 192.168.1.0 0.0.0.255 any eq 80
Router(config-ext-nacl)# permit tcp 192.168.1.0 0.0.0.255 any eq 443
Router(config-ext-nacl)# deny ip any any

-- Named ACLs also allow individual entries to be
-- removed or inserted at a specific sequence
-- number without recreating the entire list

Named ACLs are generally preferred over numbered ACLs in modern configurations, since the descriptive name makes the ACL's purpose immediately clear, and individual entries can be edited without deleting and rebuilding the entire list — a significant practical advantage over the numbered ACL syntax, which requires removing and re-adding the entire list to make even a small change.

Verifying ACL Configuration and Hits

Router# show access-lists

Extended IP access list WEB-TRAFFIC
    10 permit tcp 192.168.1.0 0.0.0.255 any eq 80 (245 matches)
    20 permit tcp 192.168.1.0 0.0.0.255 any eq 443 (1502 matches)
    30 deny ip any any (18 matches)

The match counters shown in show access-lists are invaluable for troubleshooting — confirming that a specific rule is actually being hit (or unexpectedly not being hit) is often the fastest way to determine whether an ACL is behaving as intended, particularly when traffic is being unexpectedly blocked or unexpectedly allowed through.

Why ACL Fluency Is a Core Security Skill

Access Control Lists appear throughout nearly every security-related networking task — restricting management access to network devices, controlling which traffic can traverse between network segments, and identifying traffic for QoS or NAT policies covered later in this series. Understanding the strict top-down evaluation order, the implicit deny, correct wildcard mask calculation, and proper ACL placement relative to traffic source and destination is essential for implementing effective filtering without inadvertently blocking legitimate traffic.