Hands-On Lab: Configuring Named ACLs

Lab Objective

Configure a named extended ACL, verify it functions identically to a numbered ACL, and edit a single entry using its sequence number without removing and reapplying the entire list.

Lab Purpose

Named ACLs, discussed earlier in this series, are generally preferred over numbered ACLs in modern configurations because the name documents the ACL's purpose directly, and individual entries can be inserted, removed, or edited by sequence number, avoiding the need to delete and rebuild the entire list for a small change.

Lab Topology

R1
  Gi0/0: 192.168.35.1/24 (internal LAN)
  Gi0/1: 203.0.113.5/30 (WAN, toward internet)

Task 1: Configure Basic Addressing

Configure both interfaces as shown.

Task 2: Create a Named Extended ACL

Create a named ACL called WEB-ONLY, permitting HTTP and HTTPS traffic from the internal LAN, with an explicit deny for everything else.

Task 3: Apply the ACL

Apply WEB-ONLY inbound on Gi0/0.

Task 4: Verify the Sequence Numbers

Display the ACL and note the automatically assigned sequence numbers for each entry.

Task 5: Insert a New Entry Using a Specific Sequence Number

Insert a new permit statement for DNS traffic (port 53) between the two existing entries, using a sequence number that places it correctly, without deleting and recreating the ACL.

Solution and Verification

R1(config)# interface gigabitethernet0/0
R1(config-if)# ip address 192.168.35.1 255.255.255.0
R1(config-if)# no shutdown
R1(config-if)# exit
R1(config)# interface gigabitethernet0/1
R1(config-if)# ip address 203.0.113.5 255.255.255.252
R1(config-if)# no shutdown

R1(config)# ip access-list extended WEB-ONLY
R1(config-ext-nacl)# permit tcp 192.168.35.0 0.0.0.255 any eq 80
R1(config-ext-nacl)# permit tcp 192.168.35.0 0.0.0.255 any eq 443
R1(config-ext-nacl)# deny ip any any

R1(config)# interface gigabitethernet0/0
R1(config-if)# ip access-group WEB-ONLY in

R1# show ip access-lists WEB-ONLY

Extended IP access list WEB-ONLY
    10 permit tcp 192.168.35.0 0.0.0.255 any eq www
    20 permit tcp 192.168.35.0 0.0.0.255 any eq 443
    30 deny ip any any
-- IOS automatically assigned sequence numbers
-- in increments of 10, leaving room to
-- insert new entries between existing ones

R1(config)# ip access-list extended WEB-ONLY
R1(config-ext-nacl)# 15 permit udp 192.168.35.0 0.0.0.255 any eq 53

-- Using sequence number 15 places this new
-- entry precisely between the existing 10
-- and 20, without touching either of them
-- or the deny statement at 30

R1# show ip access-lists WEB-ONLY

Extended IP access list WEB-ONLY
    10 permit tcp 192.168.35.0 0.0.0.255 any eq www
    15 permit udp 192.168.35.0 0.0.0.255 any eq 53
    20 permit tcp 192.168.35.0 0.0.0.255 any eq 443
    30 deny ip any any

Key Takeaway

The gap left between automatically assigned sequence numbers (typically increments of 10) exists specifically to allow inserting new entries later without renumbering or recreating the entire ACL — this is a significant practical advantage over the numbered ACL syntax used in earlier labs, which requires removing and re-adding the complete list to make even a single small change.