⭐ ACLs — The Complete CCNA Review
(Covers concepts, logic, placement rules, and every command you need to know cold.)
1) What ACLs Do
ACL = ordered list of permit/deny statements.
ACLs are used for:
-
Packet filtering (L2-L4)
-
Controlling access to networks
-
NAT qualification (interesting traffic)
-
QoS classification
-
Route filtering (BGP/OSPF distribute-list)
Cisco IOS processes ACLs:
-
Top → Bottom
-
First match wins
-
If no match → implicit deny all
2) Standard ACLs
What they filter:
Only source IP address
(No destination, no ports — nothing else)
Best placement:
→ Closest to the destination (minimize accidentally blocking legitimate traffic)
Number ranges:
-
1–99 (legacy)
-
1300–1999 (expanded)
Named ACL: yes, supported.
Standard ACL Syntax
Create:
Named variant:
Apply to interface:
Examples
Permit only LAN 10.1.1.0/24
Deny one host
Named version
3) Extended ACLs
What they filter:
Everything Standard can filter PLUS
Best placement:
→ Closest to the source (filter early)
Number ranges:
-
100–199 (legacy)
-
2000–2699 (expanded)
Extended ACL Syntax
Single-line:
Named:
Apply:
4) Wildcard Masks Refresher
0 = “must match”
255 = “don’t care”
Examples:
Reverse of subnet mask.
5) Extended ACL Port Keywords (must know)
| Keyword | Meaning |
|---|
| eq | equal to |
| gt | greater than |
| lt | less than |
| neq | not equal |
| range | port range |
Examples:
6) Extended ACL Examples (Exam Level)
Permit HTTP from 10.1.1.0/24 to server 172.16.0.10
Block DNS from anywhere to 8.8.8.8
Permit ICMP ping only
Allow established TCP (“return traffic”)
7) Applying ACLs (Interface Direction Rules)
Direction is from perspective of interface.
Example:
8) Placement Rules (big test topic)
Standard ACLs → near destination
Why? They only classify by source, so near source could block too broadly.
Extended ACLs → near source
Why? You have granular control with source/destination + ports → filter early.
Never apply ACLs to:
9) ACL Verification Commands
View all ACLs
View specific ACL
View interface ACL binding
View packet counters
(Counters increment only when matched → exam trick.)
10) Implicit Deny — Must Know
If no permit is matched → deny all automatically.
To allow all at end:
11) Named ACL Editing
This is why named ACLs are preferred.
Editing:
You cannot “edit” numbered ACLs — only recreate them.
12) ACL Use Cases (CCNA-Level)
Traffic filtering
Block web access:
NAT “interesting traffic”
VTY (SSH/Telnet) restrictions
13) ACLs on SVIs (Layer 3 Switches)
Same syntax — applied to SVIs like router interfaces:
14) Exam Traps You Must Defend Against
-
Standard ACL placed near source = blocks too much
-
Using subnet mask instead of wildcard mask
-
Wrong direction (in vs out)
-
Implicit deny killing all traffic
-
Forgetting permit ip any any for “allow rest”
-
Placing “established” ACL incorrectly
Using hosts in wrong position (source vs destination)
Named ACLs — Concepts, Syntax, and Configuration
(Complete CCNA-level mastery)
1) What Makes Named ACLs Different?
Named ACLs were added to solve the biggest problem with numbered ACLs:
🔥 Numbered ACLs cannot be edited in place.
— You must delete and recreate them if you need to change one line.
Named ACLs fix that:
⭐ Named ACLs allow:
2) Types of Named ACLs
You must specify type when creating a named ACL:
The “ip access-list” keyword is what activates Named ACL mode.
3) Core Syntax Difference
Numbered ACL (old method)
Flat list → no editing → must recreate.
Named ACL (new method)
You enter a sub-configuration mode:
Or for extended:
Key difference:
-
You see prompts:
(config-std-nacl)# or (config-ext-nacl)#
-
Sequence numbers added automatically (10,20,30…)
4) Named ACL Configuration (Standard)
✔ Create:
✔ Add a new line:
✔ Delete a single entry:
✔ Show:
5) Named ACL Configuration (Extended)
✔ Create:
✔ Add new line at top:
✔ Delete only one line:
✔ Reorder (sequence numbering):
This renumbers: 10,20,30,…
6) Applying Named ACLs to Interfaces
Identical to numbered ACLs:
Or:
The ACL name replaces the number.
7) Why Named ACLs Are Preferred (Cisco Exam Logic)
1. Easy editing
— Add/remove one line without deleting the entire ACL.
2. Human-readable
— “BLOCK-TELNET-IN” tells you exactly what it does.
3. Resequencing possible
— This is an exam trick.
You can renumber (you cannot on numbered ACLs).
4. All modern deployments use named ACLs
— Especially on Catalyst L3 switches, routers, firewalls.
8) Named ACLs — FULL Syntax List (Exam Fast Sheet)
Create:
Inside mode:
Edit:
Resequence:
Apply to interface:
9) Full Named ACL Example — Standard (Exam Style)
Create ACL:
Apply to VTY:
10) Full Named ACL Example — Extended (Exam Style)
Create:
Apply:
11) Exam Traps About Named ACLs
❌ Trap: Forgetting to specify “standard” or “extended”
Correct:
❌ Trap: Trying to edit numbered ACLs
Not allowed.
❌ Trap: Forgetting sequence numbers
IOS adds them automatically, but you must remove them by number:
❌ Trap: Adding entries without going into ACL mode
This is:
—that’s numbered, not named.
