CISCO ACCESS CONTROL LISTS REVISION

If you find this page useful check out my other revision pages:

• Last minute revision guide
• Cisco IOS commands
• Layer 2 switching
• VLANS
• Spanning Tree Protocol - STP
• ISDN
• Novell IPX
• Access Control Lists - ACL

For other useful CCNA study guides, CCNA practice exams and technical training, see my certification and networking links page.

ACCESS CONTROL LISTS (ACL)

Access Control Lists are used to:

• Prioritise traffic
• Restrict or reduce updates
• Provide basic security
• Block types of traffic

Access control list placement

• Standard ACLs - Place as close to destination as possible.
• Extended ACLs - Place as close to source of traffic as possible.

• Only one ACL per port per direction is allowed.
• ACL are more efficient on outbound port.
• If a packet does not match the ACL statement then it will be implicitly denied.
• Once a packet matches an ACL statement no other checks are made, it is permitted.

ACL IOS COMMANDS

Standard ACLs - Used to permit or deny an entire protocol suite.

The following two statements have the same effect:

Router(config)# access-list 1 permit 0.0.0.0 255.255.255.255
Router(config)# access-list 1 permit any

The following two statements also have the same effect:

Router(config)# access-list 1 permit 172.30.16.29 0.0.0.0
Router(config)# access-list 1 permit host 172.30.16.29

Extended ACLs - Used to permit or deny specific protocols

Protocol ranges are used in ACL statements to deny specific protocols. Below are the ones you will need for your CCNA.

Use the following table to permit or deny specific protocols, ports or ranges of port numbers, an example ACL follows.

Router(config)# access-list 101 deny tcp 172.16.4.0 0.0.255.255 any eq 23
Router(config)# access-list 101 permit ip any any established - Established keyword used to connect with a TCP established connection.

Named ACLs

Named access control lists are another way of creating ACLs, any example follows.

Router(config)# ip access-list standard Nik
Router(config std-nacl)# deny any log - used to deny log packets.

Viewing ACLs

Router(config)# show access-lists - shows all access lists.
Router(config)# show access-list 101 - shows access list 101.
Router(config)# show ip interface - used to find out which access lists are on which interfaces.

Configuring ACLs on an interface

Router(config)# interface s1
Router(config-if)# ip access-group 1 out /in - out bound is the default.

Removal of ACLs

Router(config)# no access-list 1

Nik Makris is certified
under the CCNA® program