Welcome back! In our previous session, we established the fundamental principles of how Access Control Lists (ACLs) function as packet filters, focusing on their processing logic and the all-important implicit deny rule. Now, it's time to translate that theory into practice.
This lesson will guide you through the process of configuring and applying your first ACL. We will focus specifically on standard numbered ACLs, which filter traffic based on the source IP address. By the end of this session, you will be able to create, apply, and verify a standard ACL on a Cisco router to meet a specific network policy, a crucial skill for your upcoming project.
Standard Numbered ACLs: The Fundamentals
As we touched on previously, standard ACLs are the simplest type, as they only inspect the source IP address of a packet. The "numbered" part of their name refers to how they are identified on the router.
Free CCNA | Standard ACLs | Day 34 | CCNA 200-301 Complete Course
This video segment from Jeremy's IT Lab explains the different types of ACLs and specifically highlights the number ranges used to identify standard ACLs.
Watch the clip from ACL types. Take note of the number ranges reserved for standard ACLs: 1-99 and 1300-1999. When you configure a numbered ACL, you must use a number from one of these ranges.
The Golden Rule of Placement
Because standard ACLs only filter by the source address and have no visibility into the packet's destination, their placement in the network is critical. Applying them in the wrong place can inadvertently block more traffic than you intend. This leads to a crucial best practice:
Rule of Thumb: Place standard ACLs as close to the destination of the traffic as possible.
Let's watch a brief explanation of why this rule is so important.
Free CCNA | Standard ACLs | Day 34 | CCNA 200-301 Complete Course
This clip explains the rationale behind the placement rule for standard ACLs.
Watch the explanation from the rule-of-thumb. Understanding this will help you avoid common configuration mistakes.
Configuring a Standard Numbered ACL
Configuring an ACL is a three-step process:
- Create the ACL and define its permit/deny rules (Access Control Entries, or ACEs).
- Apply the ACL to a router interface in a specific direction (in or out).
- Verify that the ACL is configured correctly and is filtering traffic as expected.
Let's break down the commands for each step.
Step 1: Create the ACL
You create the ACL itself in global configuration mode. Each line you add becomes an Access Control Entry (ACE) in the list.
How to configure standard ACLs on Cisco routers
This article from ITNetworkingSkills provides a detailed breakdown of the commands used to create a standard numbered ACL. It's an excellent text reference that complements the video content.
Read the section titled "Configuring standard numbered ACLs on Cisco routers". Focus on the access-list command syntax and the different ways to specify a source address: Using an IP address and a wildcard mask. Using the host keyword for a single device. Using the any keyword to match all addresses. Also, pay attention to the remark command, which is useful for documenting your ACLs, and the verification commands shown.
To summarize the key syntax:
- To create an ACE:
R1(config)# access-list <1-99> {permit | deny} {<source-ip> <wildcard-mask> | host <host-ip> | any} - To add a description:
R1(config)# access-list <1-99> remark <your-description-here>
Remember, because of the implicit deny, if you want to block one specific network but allow all others, your ACL must contain a deny statement for that network followed by a permit any statement.
Step 2: Apply the ACL to an Interface
Creating the ACL doesn't do anything on its own. You must apply it to an interface for it to start filtering traffic. This is done from interface configuration mode.
The command is:R1(config-if)# ip access-group <1-99> {in | out}
Notice that the command to apply the list is ip access-group, not access-list. You must also specify the direction: in for inbound traffic entering the interface, or out for outbound traffic exiting it.
Step 3: Verify the ACL
After configuration, you must verify your work. The two most important commands are:
show access-lists: This command displays all configured ACLs on the router, their sequence numbers, and the number of packets that have matched each line (the "hit count"). This is invaluable for troubleshooting.show ip interface <interface-name>: This shows you which ACLs are applied to a specific interface and in which direction.
Practical Lab: Configuring and Testing a Standard ACL
Now, let's walk through a complete practical example. The following lab video will guide you through configuring, applying, and testing standard ACLs to meet two distinct requirements.
FREE CCNA Lab 029: Standard ACLs (Access Control Lists Part 1)
This lab walkthrough from Jeremy's IT Lab is a perfect hands-on demonstration of everything we've discussed. Follow along as the instructor configures and verifies two different ACL scenarios.
First, watch how to fulfill the requirement to permit one network while blocking others. Pay attention to the use of a single permit statement and relying on the implicit deny. Configuration Application and Testing Next, see how to fulfill a different requirement: denying a single host while permitting all other traffic. This demonstrates the importance of statement order and the explicit use of permit any. Updating the ACL Final Application and Testing
Command Quick Reference
For your convenience, here is a summary of the key commands for standard numbered ACLs. You can refer to this as you work on your project.
| Task | Command | Mode |
|---|---|---|
| Create/Add an ACE | access-list <number> {permit|deny} <source-criteria> |
Global Config (config) |
| Add a Remark | access-list <number> remark <text> |
Global Config (config) |
| Apply to an Interface | ip access-group <number> {in|out} |
Interface (config-if) |
| Verify All ACLs | show access-lists |
Privileged EXEC (#) |
| Verify Interface Application | show ip interface <interface> |
Privileged EXEC (#) |
Conclusion
In this lesson, you have moved from theory to practice by learning the complete workflow for implementing a standard numbered ACL. You now have the practical skills to enforce basic security policies by filtering traffic based on its source.
Key Takeaways:
- Standard numbered ACLs use numbers 1-99 and filter traffic based only on the source IP address.
- The best practice is to place standard ACLs as close to the destination as possible.
- Configuration involves three steps: creating the list (
access-list), applying it to an interface (ip access-group), and verifying it (show access-lists). - You must account for the implicit deny at the end of every ACL, often by adding a
permit anystatement if you don't intend to block all other traffic.
While powerful, the limitation of standard ACLs is their inability to be specific. What if you only want to block web traffic from a user, but allow them to access other services? For that, you need more granular control. In our next lesson, we will explore extended ACLs, which allow you to filter traffic based on source and destination IPs, protocols, and port numbers.