Access Control Lists (ACL) Complete Guide

ACL processing logic

Packets are evaluated against entries from top to bottom. The first matching entry decides the action; later entries are not evaluated. When no entry matches, an implicit deny is normally applied at the end.

• Put specific exceptions before broad rules.
• Avoid shadowed entries that can never match.
• Apply the ACL in the correct interface and direction.
• Remember that control-plane, management-plane and switched traffic may use different policy mechanisms.

Standard, extended and named ACLs

Placement principles are guidelines, not rigid laws. Operations, asymmetric routing, hardware resources and policy ownership can change the best location.

Wildcard masks

A Cisco-style IPv4 wildcard mask tells the ACL which address bits must match. A wildcard bit of 0 means “compare this bit”; a bit of 1 means “ignore this bit.” For a contiguous subnet, the wildcard is the inverse of the subnet mask.

Protocols, ports and return traffic

An extended ACL can match TCP, UDP, ICMP and other IP protocols. TCP and UDP port operators commonly include eq, range, lt, gt and neq. A stateless ACL does not automatically permit return traffic merely because the original request was allowed.

The TCP established keyword on some platforms only checks TCP flag conditions; it is not equivalent to a stateful firewall session table. UDP has no equivalent connection flag, so bidirectional policy must be designed explicitly.

Configuration examples

ip access-list extended USER_TO_SERVER
 10 permit tcp 10.20.0.0 0.0.255.255 host 10.50.10.25 eq 443
 20 permit icmp 10.20.0.0 0.0.255.255 host 10.50.10.25 echo
 90 deny ip any any log
!
interface Vlan20
 ip access-group USER_TO_SERVER in

show access-lists
show ip interface
show ipv6 access-list
show logging
show platform hardware capacity acl

Design and troubleshooting

1. Write the business flow first: source, destination, service, direction and expected return traffic.
2. Confirm DNS, DHCP, authentication, monitoring and ICMP dependencies.
3. Use sequence numbers and remarks so the policy is reviewable.
4. Check hit counters, but remember counters can reset or be hardware-specific.
5. Test from the real source; locally generated device traffic may bypass an interface ACL.
6. Check route and NAT order of operations for the platform.
7. Limit logging on high-volume denies to protect CPU and log systems.
8. Review stale entries regularly and document an owner and expiry date.

Interview focus

Use these points to practise concise, operations-focused answers. Explain the concept first, then give a verification or troubleshooting example.

• How are ACL entries processed? Top to bottom, with the first match deciding the action.
• What happens when no ACE matches? An implicit deny normally drops the packet.
• What does wildcard bit 0 mean? The corresponding address bit must match.
• Why is a stateless ACL different from a firewall? It does not maintain a complete bidirectional session state table.
• Where is an extended ACL commonly placed? Near the source, although actual design requirements can justify another location.

Quick self-check

Frequently asked questions

Standards and further reading

• Cisco IOS XE ACL configuration guide
• NIST SP 800-41 Rev. 1 — Guidelines on Firewalls and Firewall Policy

Continue learning