Home > Access List Tutorial

Access List Tutorial

February 13th, 2011 Go to comments

In this tutorial we will learn about access list.

Access control lists (ACLs) provide a means to filter packets by allowing a user to permit or deny IP packets from crossing specified interfaces. Just imagine you come to a fair and see the guardian checking tickets. He only allows people with suitable tickets to enter. Well, an access list’s function is same as that guardian.

Access lists filter network traffic by controlling whether packets are forwarded or blocked at the router’s interfaces based on the criteria you specified within the access list.

To use ACLs, the system administrator must first configure ACLs and then apply them to specific interfaces. There are 3 popular types of ACL: Standard, Extended and Named ACLs.

Standard IP Access List

Standard IP lists (1-99) only check source addresses of all IP packets.

Configuration Syntax

access-list access-list-number {permit | deny} source {source-mask}

Apply ACL to an interface

ip access-group access-list-number {in | out}

Example of Standard IP Access List

Standard_ACL_Example1.jpg

Configuration:

In this example we will define a standard access list that will only allow network 10.0.0.0/8 to access the server (located on the Fa0/1 interface)

Define which source is allowed to pass:

Router(config)#access-list 1 permit 10.0.0.0 0.255.255.255

(there is always an implicit deny all other traffic at the end of each ACL so we don’t need to define forbidden traffic)

Apply this ACL to an interface:

Router(config)#interface Fa0/1

Router(config-if)#ip access-group 1 out

The ACL 1 is applied to permit only packets from 10.0.0.0/8 to go out of Fa0/1 interface while deny all other traffic. So can we apply this ACL to other interface, Fa0/2 for example? Well we can but shouldn’t do it because users can access to the server from other interface (s0 interface, for example). So we can understand why an standard access list should be applied close to the destination.

Note: The “0.255.255.255” is the wildcard mask part of network “10.0.0.0”. We will learn how to use wildcard mask later.

Extended IP Access List

Extended IP lists (100-199) check both source and destination addresses, specific UDP/TCP/IP protocols, and destination ports.

Configuration Syntax

access-list access-list-number {permit | deny} protocol source {source-mask} destination {destination-mask} [eq destination-port]

Example of Extended IP Access List

Extended_ACL_Example1.jpg

In this example we will create an extended ACL that will deny FTP traffic from network 10.0.0.0/8 but allow other traffic to go through.

Note: FTP uses TCP on port 20 & 21.

Define which protocol, source, destination and port are denied:

Router(config)#access-list 101 deny tcp 10.0.0.0 0.255.255.255 187.100.1.6 0.0.0.0 eq 21

Router(config)#access-list 101 deny tcp 10.0.0.0 0.255.255.255 187.100.1.6 0.0.0.0 eq 20

Router(config)#access-list 101 permit ip any any

Apply this ACL to an interface:

Router(config)#interface Fa0/1

Router(config-if)#ip access-group 101 out

Notice that we have to explicit allow other traffic (access-list 101 permit ip any any) as there is an “deny all” command at the end of each ACL.

As we can see, the destination of above access list is “187.100.1.6 0.0.0.0” which specifies a host. We can use “host 187.100.1.6” instead. We will discuss wildcard mask later.

In summary, below is the range of standard and extended access list

Access list type Range
Standard 1-99, 1300-1999
Extended 100-199, 2000-2699

Comments (31) Comments
Comment pages
1 7 8 9 458
  1. cedtech
    July 22nd, 2016

    Standard list are applied near the destination; Extended near the source. Thus, on the extended example why is it not applied to interface fa0/0 since its the closet and you are using an extended access list?

    interface Fa0/0

    ip access-group 101 in

  2. cupo
    July 23rd, 2016

    i donot under stand this statement, can any one explain it simply please .

    Notice that we have to explicit allow other traffic (access-list 101 permit ip any any) as there is an “deny all” command at the end of each ACL.

  3. Kathryn
    July 23rd, 2016

    La Liga cheap apparels online and Summer League finals game used jerseys cheap.

  4. Mon
    July 26th, 2016

    @cupo : at the end of every acl is an implicit deny all command. Any traffic that is not given any kind of permit statement in the acl is by default denied [ if it is not explicitly(directly) defined in the acl , it is implicitly(indirectly) denied ] hope it helps

  5. Anonymous
    July 29th, 2016

    After 187.100.1.6 the four octetes are 0 . I don’t exactly understand is that wild card subnet?

  6. Anonymous
    August 1st, 2016

    Cool content, thanks

  7. cisco
    August 4th, 2016

    Can you please explain wild card mask in detail?

  8. rick
    August 12th, 2016

    Wild card masks are basically the inverse regular mask. so 255.255.255.255 becomes 0.0.0.0.
    255.255.255.0 becomes 0.0.0.255. but if you need other values, the inverse mask (wild card mask) becomes the block size MINUS 1 so 255.255.255.240 (block size 16) becomes wild card mask 0.0.0.15. …224 (block size 32) becomes …31 etc etc.

    Hope that helps.

  9. cherry
    August 13th, 2016

    why v dont see questions in lab sim?
    we see only answers. please hw to see relevant questions.

  10. Maximo
    August 29th, 2016

    nba 2k14 jersey sleeves, and mlb shop black friday coupon codes up to 59% discount off!

  11. Kandice
    September 7th, 2016

    Buy the cheapest a.j. klein jersey kids and give ted larsen jersey kids free,recommend best quality jerseys of star, world brand soprts jerseys.

  12. Anonymous
    October 1st, 2016

    HI

  13. Jeannie
    October 7th, 2016

    cheap nfl jerseys | Cheap NFL Jerseys, Authentic Jerseys From China Free Shipping

  14. Rufus
    December 6th, 2016

    How to get cheap ny giants jerseys? Tips you may used. cheap authentic nba jerseys from
    china

  15. Anonymous
    December 7th, 2016

    cheery same here too i cant see the question and i just only see the answer .Its awkward :(

  16. Bertie
    December 8th, 2016

    Hi, i believe that i saw you visited my weblog
    so i came to go back the want?.I’m attempting to in finding issues to enhance
    my site!I suppose its good enough to use a few of your ideas!!

    cheap NFL jerseys

  17. Zelma
    December 22nd, 2016

    always i used to read smaller articles which as well
    clear their motive, and that is also happening with
    this post which I am reading at this place.
    Team CA. #27 Alex Pietrangelo Red 2016 World Cup Stitched
    NHL Jersey

  18. Kimberley
    December 22nd, 2016

    What is size of cheap pirates jerseys may have? Know more about here
    – Cowboys No19 Miles Austin White Thanksgiving Stitched Youth NFL Jersey
    Wholesale

  19. Anonymous
    December 28th, 2016

    i have one question ,that the system ping at one said but ping the other said
    example: 10.0.0.1 ping 10.0.0.2 but
    10.0.0.3 can not ping 10.0.0.1

  20. Leona
    December 28th, 2016

    Excellent weblog here! Also your website quite a bit
    up very fast! What host are you using? Can I am getting
    your associate hyperlink on your host? I desire my website loaded up
    as quickly as yours lol
    cheap jerseys

  21. Kirsten
    December 29th, 2016

    cheap nfl throwback jerseys from china Amazon Shopper online retail,
    with link: Seminoles 80 Rashad Greene White Limited Stitched Youth NCAA Jersey

  22. Anonymous
    December 30th, 2016

    Very well router security ACL….but this security only use to router and acl good manage to traffic signal and this security bast security in router

  23. Jeffrey
    January 7th, 2017

    Appreciation to my father who told me concerning this website, this web site is actually remarkable.

    cheap NFL jerseys

  24. Winifred
    January 8th, 2017

    Hi to every body, it’s my first go to see of this webpage; this website contains awesome and genuinely good data in support
    of readers.
    cheap jerseys

  25. Doug
    January 13th, 2017

    I am fake nfl jerseys for sale supplier online, take coupon code here: cheap game jerseys

  26. Chong
    January 13th, 2017

    Great place to order cheap Antonio Brown jerseys by Paypal.

    cheap fc barcelona jerseys

  27. Otis
    January 14th, 2017

    Where to buy wholesale Byron Bell jerseys? Come here.
    wholesale nba argentina jerseys

  28. Jamel
    January 14th, 2017

    Where to buy wholesale Eddie Goldman jerseys? Come here.
    23 Elite Texans Arian Foster Women Jersey Stitched Nike NFL Breast Cancer Awareness Grey

  29. Anonymous
    February 4th, 2017

    Stop posting about jerseys you ass clown.

  30. Titus
    February 7th, 2017

    awesome information you guys have here what everybody’s first impressions on our site concerning real driving 3d online hack

  31. Anonymous
    February 16th, 2017

    the jersey guy is sick, this is no forum for that @bwaii brazz

Comment pages
1 7 8 9 458