Cisco Certified Network Associate (CCNA) 200-301 · Free study guide

Objective 5.6 — Configure IPv4 access control lists

An IPv4 access control list is an ordered decision list. The device evaluates entries from top to bottom and stops at the first match. If no explicit entry matches, an implicit deny applies. Correct syntax alone is insufficient: rule order, match fields, placement, direction, and attachment determine the actual policy.

Translate policy into matches

A standard ACL matches source IPv4 addresses. An extended ACL can also match protocol, destination, and transport ports. Numbered and named ACLs differ in how they are identified and maintained, not in first-match behavior. Begin with a plain-language traffic tuple: source, destination, protocol, service, desired action, interface, and direction.

A wildcard mask marks which address bits are ignored with ones and checked with zeros. It is not simply a subnet mask written in the same notation. For example, 192.0.2.0 0.0.0.255 matches the /24 range because the final eight bits may vary. Use host when exactly one address should match and any only when the policy truly covers every address.

Order from specific to broad

A broad deny above a narrow permit makes the permit unreachable. A broad permit above a narrow deny allows the traffic before the deny is considered. Sequence rules deliberately and leave room for controlled edits. Document why an entry exists; stale exceptions become difficult to assess later.

Placement should minimize unintended traffic while preserving required services. Extended lists are often useful near a source because they can identify a precise flow. Standard lists have only the source field, so placing them too early can block that source from unrelated destinations. These are design heuristics, not substitutes for tracing the real topology.

IOS command map

Create a named list with ip access-list extended USERS-IN, then enter ordered entries such as deny tcp 192.0.2.0 0.0.0.255 host 198.51.100.20 eq 22 and permit tcp 192.0.2.0 0.0.0.255 host 198.51.100.20 eq 443. Complete the list with the explicitly approved remaining behavior; otherwise the implicit deny blocks every unmatched packet. Under the user-facing routed interface, ip access-group USERS-IN in applies the list to traffic entering that interface.

Use show access-lists USERS-IN to verify sequence and match counters, show ip interface to confirm attachment and direction, and controlled positive and negative flow tests to prove policy. Preserve an authorized recovery path before changing an ACL that can affect management traffic. The addresses here are documentation examples, not permission to target a real host.

Worked scenario

Users in 192.0.2.0/24 may reach a documentation server at 198.51.100.20 over HTTPS but not SSH. Other traffic must retain its existing policy. A precise extended ACL can deny TCP from the user subnet to destination port 22, permit TCP to destination port 443, then express the remaining approved behavior. Attaching it inbound on the user-facing routed interface evaluates traffic as it enters. The operator tests allowed and denied flows and checks matching counters.

Change safely

Inventory routing, management, DHCP, DNS, and control traffic before attachment. Use an authorized recovery path and a rollback condition. Validate from realistic sources; testing from the router itself may follow a different path and bypass the interface direction under study.

Verification evidence

Inspect the ACL text, sequence, attachment, interface, direction, and counters. Generate controlled positive and negative tests. Confirm counters increment on the expected entry and that logs, if enabled, are rate-conscious and useful. Recheck return traffic because a stateless ACL does not automatically create a reverse allowance.

Common traps

• Forgetting the implicit deny.
• Reading a wildcard mask like a subnet mask.
• Ignoring first-match ordering.
• Applying a correct ACL to the wrong direction.
• Testing from a path that never crosses the attachment.

Readiness checklist

• I can translate a policy into ordered entries.
• I can calculate and explain wildcard matches.
• I include placement and direction in every design.
• I verify permits, denies, counters, and return paths.