Filtering Traffic with Standard ACLs

Welcome back! In our previous lesson, we established the fundamental logic behind Access Control Lists (ACLs): how routers process them using top-down, first-match logic, and the critical role of the invisible "implicit deny" rule. You now understand the why and how of ACL processing.

Today, we'll build on that foundation and move from theory to practice. This lesson is all about configuration. Our goal is to configure and apply standard ACLs to filter traffic based on a packet's source IP address. You will learn the specific Cisco IOS commands to create these filters and attach them to router interfaces, turning abstract rules into tangible network security controls. We will cover both numbered and named standard ACLs, which are the two primary ways to implement them.

1. What Makes a Standard ACL "Standard"?

Before we type any commands, let's quickly review the core characteristic of a standard ACL. As we touched on before, there are two main types of IP ACLs: standard and extended.

• Standard ACLs: These are the simpler of the two. They filter traffic based only on the source IP address of a packet. They don't look at the destination, the protocol (TCP/UDP), or port numbers.
• Extended ACLs: These are more powerful and complex, allowing you to filter based on source IP, destination IP, protocol, port numbers, and more. We will cover these in the next lesson.

Because standard ACLs only look at the source, their application requires careful thought. As you'll see, where you place them in the network is just as important as the rules themselves.

Standard ACLs can be created in two ways:

1. Numbered ACLs: Identified by a number (1-99 or 1300-1999).
2. Named ACLs: Identified by a descriptive name (e.g., BLOCK_GUEST_WIFI).

We'll start with the classic numbered ACLs.

2. Configuring Numbered Standard ACLs

A numbered standard ACL is created in global configuration mode using the access-list command. Each rule, or Access Control Entry (ACE), is a separate line in your configuration.

To get a comprehensive overview of the syntax and key concepts like wildcard masks, please watch the following segment from Jeremy's IT Lab.

A Closer Look at Wildcard Masks

The most confusing part of ACLs for many is the wildcard mask. You are comfortable with subnet masks, which use binary 1s to identify the network portion of an address. A wildcard mask is the inverse.

• A 0 in a wildcard mask bit means "the corresponding bit in the IP address must match."
• A 1 in a wildcard mask bit means "the corresponding bit in the IP address does not matter (it's a wildcard)."

A simple way to calculate the wildcard mask for a given subnet is to subtract the subnet mask from 255.255.255.255.

Example:

• Subnet: 192.168.1.0 /24
• Subnet Mask: 255.255.255.0
• Wildcard Calculation:

    255.255.255.255
  - 255.255.255.  0
  -------------------
    0  .0  .0  .255
  

• ACL Entry: access-list 10 permit 192.168.1.0 0.0.0.255
  This tells the router to match the first three octets (192.168.1) exactly, but the last octet can be anything.

3. Applying Standard ACLs to an Interface

Creating an ACL does nothing on its own. It's just a list of rules sitting in the router's memory. To make it active, you must apply it to an interface in a specific direction.

• Command: ip access-group {number | name} {in | out} (used in interface configuration mode)
• Direction:
  • in: The ACL is checked for packets entering this interface.
  • out: The ACL is checked for packets exiting this interface.

The Golden Rule of Standard ACLs

Because standard ACLs can't see the destination, placing them incorrectly can have unintended consequences. If you place a standard ACL too close to the source, you might block traffic you intended to allow. For example, blocking a user from accessing one server might also block them from accessing the internet.

This leads to a crucial best practice: Apply standard ACLs as close to the destination as possible.

The following video segment demonstrates this principle perfectly, showing how the same ACL can succeed or fail based entirely on where it's applied.

4. A Practical Scenario

Let's apply these concepts. Look at the network topology below.

Goal: Prevent users on the 'Students' LAN from accessing the Server, but allow all other traffic (including from the 'Teachers' LAN).

Plan:

1. Create a standard ACL that denies traffic from the 10.0.0.0/8 source network.
2. Add a rule to permit all other traffic to avoid the implicit deny rule blocking everything else.
3. Apply this ACL as close to the destination (the Server) as possible. The router closest to the server is Router0. We will apply it on the Gig0/2 interface in the outbound direction.

Here are the commands you would use on Router0:

# Enter global configuration mode
Router0> enable
Router0# configure terminal




# Rule 1: Deny traffic from the Students LAN (10.0.0.0/8)
# The wildcard mask for /8 (255.0.0.0) is 0.255.255.255
Router0(config)# access-list 10 deny 10.0.0.0 0.255.255.255




# Rule 2: Permit all other traffic
Router0(config)# access-list 10 permit any




# Enter interface configuration mode for the interface facing the server
Router0(config)# interface gigabitethernet 0/2




# Apply the ACL in the outbound direction
Router0(config-if)# ip access-group 10 out

Router0(config-if)# end

With this configuration, any packet originating from the 10.0.0.0/8 network that Router0 tries to forward out of Gig0/2 will be dropped. Any other packet will be permitted.

5. Using Named Standard ACLs

Numbered ACLs work, but they are not very descriptive. If you have many ACLs on a router, access-list 10 doesn't tell you much about its purpose. Named ACLs solve this problem and also offer more configuration flexibility.

The key differences are:

• You create them using ip access-list standard <NAME>. This enters a special ACL configuration mode.
• From this mode, you can add, delete, and reorder individual permit or deny statements using sequence numbers, which is a major advantage over numbered ACLs.

The following resource provides a text-based overview of how to configure and assign named ACLs.

Here is a visual example of the configuration in action.

Notice how much more readable ip access-group BlockStudents out is compared to ip access-group 10 out. In a complex network, this clarity is invaluable for management and troubleshooting.

Conclusion

Today you've translated ACL theory into practical skills. You now have the commands to create basic network filters that permit or deny traffic based on its origin.

Key Takeaways:

• Standard ACLs filter packets based only on the source IP address.
• They can be numbered (1-99, 1300-1999) or named. Named ACLs are generally preferred for their readability and flexibility.
• The access-list command (for numbered) or ip access-list standard <NAME> (for named) is used to define the rules.
• Wildcard masks are essential for matching ranges of IP addresses and are the inverse of subnet masks.
• An ACL is activated by applying it to an interface with the ip access-group command in either the in or out direction.
• The best practice for standard ACLs is to place them as close to the destination as possible.

So far, our filtering has been blunt—we can only block traffic based on where it comes from. What if we need to be more precise? For instance, what if we want to allow users to browse websites (HTTP/HTTPS) but block them from using FTP? To do this, we need to inspect more than just the source IP.

In our next lesson, we will explore extended ACLs. You will learn to configure and apply these more advanced filters to control traffic based on source, destination, protocol, and port numbers, giving you far more granular control over your network.