Cisco IOS ACLs in practice: wildcard bits, standard and extended ACL examples

How IOS ACLs are built

An access control list (ACL) is a numbered or named list of permit and deny lines called access control entries. Design guidance on why and where to use them is in Access control lists: purpose, types, placement and best practice; this note is the hands-on part. The rules that trip people up most:

• Lines are checked top to bottom and the first match decides. Later lines are never reached for that packet.
• Every ACL ends with an invisible deny any. An ACL with only deny lines blocks everything.
• An ACL does nothing until you apply it: to an interface with ip access-group NAME in|out, or to remote login lines with access-class NAME in.
• One ACL per interface, per direction, per protocol.

Wildcard bits

ACLs and routing protocol network statements use wildcard masks rather than subnet masks. A 0 bit means "this bit must match"; a 1 bit means "ignore this bit". For a normal subnet, the wildcard is 255.255.255.255 minus the subnet mask: /24 is 0.0.0.255, /26 is 0.0.0.63, /30 is 0.0.0.3. Two shortcuts save typing: host 10.1.1.5 means 10.1.1.5 0.0.0.0, and any means 0.0.0.0 255.255.255.255.

Wildcards do not have to be contiguous. 10.0.0.0 0.0.254.255 checks the lowest bit of the third octet, so it matches only even third octets (10.0.0.x, 10.0.2.x, 10.0.4.x and so on). Clever masks like this are compact but hard to read later, so use them sparingly. The wildcard mask calculator converts between masks and checks your work.

Standard ACL example

Standard ACLs (numbers 1 to 99 and 1300 to 1999, or named) match only the source address. Here only the IT subnet and one monitoring server may manage the router over SSH:

ip access-list standard MGMT-ONLY
 10 remark IT team and monitoring server
 10 permit 10.10.50.0 0.0.0.255
 20 permit host 10.10.60.15
 30 deny any log
!
line vty 0 15
 access-class MGMT-ONLY in
 transport input ssh

The explicit deny any log does the same job as the implicit deny but logs attempts, which is useful evidence of probing.

Extended ACL example

Extended ACLs (100 to 199 and 2000 to 2699, or named) match source, destination, protocol and ports. Here a guest VLAN may use DNS and web browsing but must not reach any internal network:

ip access-list extended GUEST-IN
 10 permit udp 172.30.0.0 0.0.0.255 host 10.10.1.53 eq 53
 20 deny ip 172.30.0.0 0.0.0.255 10.0.0.0 0.255.255.255
 30 permit tcp 172.30.0.0 0.0.0.255 any eq 443
 40 permit tcp 172.30.0.0 0.0.0.255 any eq 80
 50 deny ip any any log
!
interface Vlan30
 ip access-group GUEST-IN in

Line 10 must come before line 20, or DNS to the internal server would be denied. Named ACLs with sequence numbers let you insert a line (15 permit ...) or delete one (no 30) without retyping the list. Check results with show access-lists, which shows a match counter on each line, and show ip interface Vlan30 to confirm the ACL and direction.

Real-world example: a college guest network

A further education college found that students on the guest Wi-Fi could open the internal library catalogue's admin page. The guest VLAN interface had an ACL, but its first line was permit tcp any any eq 443, placed above the deny for internal networks, so HTTPS to internal servers matched first. Reordering the lines so the deny for 10.0.0.0/8 came before the web permits, and adding a specific permit for the public library catalogue server, fixed it. The counters in show access-lists confirmed traffic was now hitting the deny line.