ACLs in Cisco IOS can be used to control traffic flow and to use it as a simple list to define another function like NATing or Route-Maps. Standard Access List (ACL) in Cisco IOS are the simplest and oldest type of ACLs. Standard ACLs simply compare the Source IP Address on the packet against the IP Address defined on the ACL and decides whether to permit or deny the traffic as per the definition in the ACL.
When used to control traffic, it is recommended that the ACLs in general are applied to the interface closest to the segment where the traffic originates.
Define a Standard ACL
From the global configuation mode run the access-list command as follows
ciscorouter(config)# access-list 10 permit 10.1.1.1
ciscorouter(config)# access-list 10 permit 10.1.1.2
ciscorouter(config)# access-list 10 permit 10.1.2.0 0.0.0.255
In the above example, the access-list permits IP 10.1.1.1 & 10.1.1.2 and the network 10.1.2.0 network and everything else is denied. The Access list by default has an explicit "deny any" statement which denies everthing except from the permitted IPs and Networks. This is why there should be atleast one permit statement in an ACL when applied to an interface else you run the danger of blocking all traffic.
To display the ACL
ciscorouter# show access-lists
Standard IP access list 2
10 permit 10.1.1.1
20 permit 10.1.1.2
30 permit 10.1.2.0, wildcard bits 0.0.0.255
Please note that the order in which the rules are processed are in descending order of IP Address and not using the statement numbers. Another thing worth mentioning is the "inverse mask" used in the ACLs.
Lets take a look at the last statement in the ACL
ciscorouter(config)# access-list 10 permit 10.1.2.0 0.0.0.255
Normally, when defining a network we would defining it as 10.1.2.0/255.255.255.0. Here, in the ACL, it is the inverse. To cut a long story short, "0" indicates the bits in the address to exactly match and "1" are don't care. So, to match the network, 10.1.2.0, we mark the 1st 3 octets of the mask as "0" to indicate that they need to match while the 4th octet is "255" meaning all bits are "1" indicating all hosts in that network.
Apply ACL to Interface
Once the ACL is defined, apply it to an interface as follows from the interface config mode.
ciscorouter(config)# int fast ethernet 0/0
ciscorouter(config-if)# ip access-group 10 in
The above command applies for all the incoming traffic on the interface (defined by "10" in the command). To see the ACL used in NATing, click here
Modify the ACL
Need to be careful when modifying the ACL especially deleting an entry from the ACL can remove the complete Standard ACL. Adding a new entry to the list can be done very much the same way as earlier
For example,
ciscorouter(config)# access-list 10 permit 10.1.3.0 0.0.0.255
However, to delete an entry from the ACL, the ACL configuration mode and then delete the ACL entry using the "no" form of the command.
ciscorouter(config)# ip access-list standard 10
ciscorouter(config-std-nacl)# no permit 10.1.3.0 0.0.0.255
This should remove the entry we just added from the ACL. Else, if you try to remove from the ACL from the Global Configuration mode, you risk losing the complete ACL. Alternatively, copy the ACL onto a notepad and remove the lines you wanted to and then add the ACL back onto the router.
For Extended ACLs, click here
Leave a Reply