Welcome to your next lesson! In our last session, we explored how to use discovery protocols like CDP and LLDP to map out your network and understand how devices are physically connected. Now that you can "see" the network topology, the next logical step is to control the traffic flowing through it.
This lesson introduces a foundational network security tool: Access Control Lists (ACLs). You'll learn the fundamental principles of how ACLs operate as packet filters. We will focus on three core concepts: the criteria ACLs use to filter traffic, the critical importance of processing order, and the non-negotiable "implicit deny" rule. Mastering these concepts is essential before we move on to configuring ACLs for your project.
What is an Access Control List?
At its core, an Access Control List (ACL) is a set of rules applied to a router or switch interface that instructs the device to either permit or deny packets as they pass through. It acts as a traffic filter, providing a basic but powerful form of network security.
To start, let's get a high-level overview of what ACLs are and the kinds of traffic they can inspect.
Free CCNA | Standard ACLs | Day 34 | CCNA 200-301 Complete Course
This clip from Jeremy's IT Lab provides a concise introduction to ACLs as a security tool.
Please watch from the beginning of the topic until the diagram appears. Pay attention to the analogy of a packet filter and the different criteria an ACL can use, such as IP addresses and port numbers. Watch from this segment.
As the video mentioned, ACLs can filter traffic based on various attributes. For the CCNA, we are concerned with two primary types of IP ACLs:
- Standard ACLs: These are the simpler type. They filter traffic based only on the source IP address of the packet. Because they are not very granular, their placement in the network is critical.
- Extended ACLs: These offer much more granularity. They can filter based on a combination of source and destination IP addresses, the protocol type (like TCP, UDP, or ICMP), and even source and destination port numbers (like TCP port 80 for HTTP).
Your security background will help you appreciate how these different levels of control can be used to enforce specific network policies. For now, the key takeaway is that ACLs are lists of rules that match packet attributes.
How ACLs Process Traffic
Understanding how a router processes an ACL is more important than memorizing any single command. An ACL is not just a random collection of rules; it's an ordered, sequential list. This processing logic is the key to making them work correctly.
There are three essential concepts to grasp:
- Direction: An ACL is applied to an interface in either an inbound or outbound direction.
- Inbound ACLs filter packets as they enter an interface, before the router makes a routing decision.
- Outbound ACLs filter packets after they have been routed and are about to exit an interface.
-
Top-Down Processing: The router checks the packet against each rule (called an Access Control Entry or ACE) in the ACL, starting from the top.
-
First-Match Logic: As soon as the packet matches a rule, the router immediately executes the corresponding action (permit or deny) and stops processing the ACL. Any subsequent rules in the list are ignored for that packet.
The following video provides an excellent practical demonstration of these principles.
Free CCNA | Standard ACLs | Day 34 | CCNA 200-301 Complete Course
In this extended segment, Jeremy's IT Lab uses a sample network to walk through how an ACL filters traffic based on its placement and the order of its rules.
Watch this detailed walkthrough from start to finish. Focus on: How applying the same ACL in different directions (inbound vs. outbound) or on different interfaces dramatically changes the outcome. How the router processes the list of rules from top to bottom until it finds a match.
The Two Most Important ACL Rules
The video demonstration highlighted the core logic. Now, let's formally state the two most critical rules that govern all ACLs.
Access Control Lists - ACLs - howtonetwork.com
This text from howtonetwork.com explicitly lists the rules of ACL operation. It's a great textual reinforcement of what you just saw in the video.
Please read the sections titled "ACL Rule 2 – The Lines Are Processed Top-Down" and "ACL Rule 3 – There Is an Implicit Deny All at the Bottom of Every ACL."
To summarize and visualize these two rules:
Rule 1: Processing is Top-Down, and Stops at the First Match
The order of your rules is paramount. If a general permit rule appears before a more specific deny rule that it also covers, the deny rule will never be reached. Always place more specific rules higher up in the list.
Rule 2: There is an Implicit deny all at the End
This is the most common pitfall for newcomers. Every ACL has an invisible, un-deletable rule at the very end that denies all traffic. This means that if a packet does not match any of the rules you explicitly configure, it will be denied.
Therefore, an ACL that only contains deny statements will block everything, because any traffic not matching the deny rules will be caught by the final implicit deny. For an ACL to permit any traffic at all, it must contain at least one permit statement.
This flowchart provides a perfect mental model for the entire process.
Let's watch one more short video to drive these points home.
Free CCNA | Standard ACLs | Day 34 | CCNA 200-301 Complete Course
This final clip from Jeremy's IT Lab serves as a perfect summary, explicitly discussing the sequential processing and the implicit deny rule with clear examples.
Watch the section from this segment. Pay close attention to the example where swapping two lines in an ACL completely changes its behavior.
Conclusion
In this lesson, you've learned the fundamental theory behind how Access Control Lists operate. Understanding this logic is the most important part of working with ACLs; the configuration commands, which we'll cover next, are just the tools to implement this logic.
Key Takeaways:
- ACLs are packet filters that use rules to permit or deny traffic based on attributes like IP addresses and port numbers.
- An ACL is applied to an interface in an inbound or outbound direction.
- Rules are processed sequentially from top to bottom.
- Processing stops at the first match, and the corresponding action (permit or deny) is taken.
- Every ACL ends with an implicit
deny allrule that blocks any traffic not explicitly permitted.
In our next lesson, we will put this theory into practice. You'll learn how to configure and apply a standard numbered ACL on a Cisco router to filter traffic based on its source address.