intermediate v1 • Updated 7 hours ago

Network Security & Access Control Lists (ACLs)

An ACL (Access Control List) is a sequential collection of permit or deny rules applied to router or switch interfaces to filter network traffic based on packet header attributes.

Remember This Key Rule

ACLs evaluate sequentially top-to-bottom with an implicit deny all at the end. Standard = Source IP only; Extended = Source + Dest + Port/Protocol.

In Simple Terms

An ACL is a security bouncer for your router interfaces. As packets enter or exit an interface, the router evaluates the packet against the ACL rules from top to bottom. As soon as a match is found, the router executes the action (permit or deny) and stops checking. At the very bottom of every ACL is an invisible implicit deny all rule.

Visual Diagram & Flow

Rule 1: permit tcp 192.168.1.0/24 any eq 443MATCH -> PERMIT

Rule 2: deny ip 192.168.1.0/24 10.0.0.0/24MATCH -> DENY

Implicit: deny ip any anyDROP ALL

Why It Matters in Real Networks

ACLs are the primary mechanism for basic stateless network segmentation, traffic filtering, and restricting management access.

How It Works (Technical Breakdown)

- **Standard ACL (1-99, 1300-1999)**: Filters based ONLY on Source IP address. Placed as close to the **destination** as possible. - **Extended ACL (100-199, 2000-2699)**: Filters based on Source IP, Destination IP, Protocol (TCP, UDP, ICMP), and Port numbers (e.g. 80, 443, 22). Placed as close to the **source** as possible. - **Wildcard Masks**: Inverse of subnet masks (0 means match exactly, 255 means ignore bit). - **Direction**: Can be applied `in` (before routing decision) or `out` (after routing decision).

Real-World Analogy

A standard ACL is a bouncer who only checks where you are coming from. An extended ACL is a VIP security agent who checks your ID, where you are going, what clothes you are wearing, and what briefcase you are carrying.

Concrete Example

Extended ACL blocking Guest VLAN (192.168.50.0/24) from accessing Server LAN (10.0.0.0/24) while allowing Internet web browsing: `ip access-list extended BLOCK_GUEST_SERVER` ` deny ip 192.168.50.0 0.0.0.255 10.0.0.0 0.0.0.255` ` permit ip 192.168.50.0 0.0.0.255 any` `interface GigabitEthernet0/1` ` ip access-group BLOCK_GUEST_SERVER in`

Common Engineering Mistakes & Pitfalls

Forgetting the implicit deny at the end of every ACL, accidentally blocking all traffic when trying to filter a single host.

Prerequisites

IPv4 Addressing & Classless Architecture (CIDR) Recommended Static Routing & Default Routes Recommended

Next & Related Concepts

Explore the complete curriculum roadmap.

Concept Mastery Quiz

Test your comprehension with active-recall questions.

No quiz questions generated for this topic yet.

Active Recall Flashcards

Click each flashcard to reveal the answer and test your memory.

No flashcards created for this topic yet.

Content Versioning

Audit trail of revisions and updates for this knowledge topic.

Version	Change Summary	Author	Timestamp
v1 (Current)	Active production content	system	Sun, Aug 23, 2026 11:09 AM