Standard and Extended ACLs

An Access Control List is an ordered list of permit and deny rules the router tests against each packet. Every CCNA IPv4 ACL is either standard or extended, and the difference is simply the set of packet fields it is allowed to look at.

A standard ACL physically cannot mention a destination or a port. access-list 10 permit 10.10.10.0 0.0.0.255 says "traffic from that subnet is permitted" and nothing whatsoever about where it is going. An extended ACL adds the Layer 3 and 4 detail: access-list 100 deny tcp any host 10.10.30.10 eq 23 reads as "deny TCP, from anyone, to that one host, destined for port 23".

Order turns a correct rule into dead code. To deny one host but permit the rest of its subnet, the specific rule must sit above the broad one. Write permit 10.10.10.0 0.0.0.255 first and the host's packets match it at the top — the deny below is never reached and never fires. show access-lists proves it: an ACE with zero hits while its traffic is clearly flowing is an ACE the router never reaches.

An ACL selects addresses with a wildcard mask, the inverse of a subnet mask: a 0 bit means this bit must match, a 1 bit means do not care. This is the same inverse-mask arithmetic OSPF network statements use.

The classic trap is writing the subnet mask instead of its inverse: the wildcard for a /24 is 0.0.0.255, not 255.255.255.0.

Direction matters for efficiency. An inbound ACL is checked before the router makes its forwarding decision, so a denied packet is discarded without ever being routed. An outbound ACL is checked after routing, at the exit interface. You get one ACL per interface per direction — one in, one out — and cannot stack two inbound ACLs on the same interface.

Goal: block Telnet from the user subnet to one server, and permit everything else. That needs a destination and a port, so it is extended — and extended goes near the source.

R1(config)# ip access-list extended BLOCK-TELNET
R1(config-ext-nacl)# deny tcp 10.10.20.0 0.0.0.255 host 10.10.30.10 eq 23
R1(config-ext-nacl)# permit ip any any
R1(config-ext-nacl)# exit
!
! Apply inbound on the interface facing the user subnet
R1(config)# interface GigabitEthernet0/1
R1(config-if)# ip access-group BLOCK-TELNET in

R1# show access-lists
Extended IP access list BLOCK-TELNET
    10 deny tcp 10.10.20.0 0.0.0.255 host 10.10.30.10 eq telnet (4 matches)
    20 permit ip any any (37 matches)

• 10 and 20 are auto-assigned sequence numbers. ACEs number in tens so you can insert a 15 between them later.
• The deny line reads: protocol tcp, source the /24 (wildcard 0.0.0.255), destination the single server (host = wildcard 0.0.0.0), port eq telnet, which is 23. IOS echoes well-known ports by name.
• (4 matches) is the hit counter. Four Telnet attempts were dropped. A deny ACE stuck at zero while its traffic is clearly flowing means those packets matched an earlier line instead.
• permit ip any any is the explicit catch-all keeping every other flow alive. Without it the implicit deny would drop non-Telnet traffic too.
• show ip interface GigabitEthernet0/1 | include access list confirms which ACL is bound and in which direction — the fastest way to catch an ACL on the wrong interface or facing the wrong way.

• Standard (1-99, 1300-1999) matches source only, so place it near the destination.
• Extended (100-199, 2000-2699) matches source, destination, protocol, and port, so place it near the source.
• Wildcard mask: 0 means must match, 1 means do not care. A /24 is 0.0.0.255; host is 0.0.0.0; any is 255.255.255.255.
• Top-down, first match wins, then stop — put specific ACEs above general ones.
• An implicit deny any ends every list, so an ACL with no permit drops everything.
• Verify with show access-lists for hit counts and show ip interface for which ACL and which direction.
• Interface ACLs never filter the router's own originated traffic; use access-class on the VTY lines for that.