Access control lists: purpose, types, placement and best practice
In short: ACLs are ordered permit and deny rules that filter traffic by addresses, protocols and ports. Standard ACLs match only the source address and go near the destination; extended ACLs match much more and go near the source. Routers read ACLs top-down and drop anything that doesn’t match.
What ACLs are for
By default a router forwards any packet it has a route for. An access control list is an ordered set of rules, called access control entries (ACEs), that permit or deny packets based on their headers. Typical uses:
- Security: allow only authorised users to reach a sensitive network such as HR.
- Traffic control: block unwanted traffic, such as video on a busy WAN link, or accept routing updates only from known sources.
- Service filtering: allow email in but block Telnet; limit FTP or HTTP to certain groups.
- Identifying traffic for other features, such as giving voice priority with QoS or choosing what NAT translates.
Today firewalls carry most security policy, but ACLs remain essential on routers and switches.
Types of ACL
| Type | Matches on | Numbers |
|---|---|---|
| Standard | Source IPv4 address only | 1 to 99 and 1300 to 1999 |
| Extended | Source and destination address, protocol, ports and more | 100 to 199 and 2000 to 2699 |
| Named | Either type, with a meaningful name instead of a number | Any descriptive name |
Named ACLs are preferred: BLOCK-GUEST-TO-SERVERS explains itself; 101 doesn't, and named ACLs let you insert or delete single lines.
How ACLs are processed
- Put the most specific lines first: a broad permit near the top hides everything below it.
- Every ACL needs at least one permit, or it blocks everything.
Inbound or outbound, and where to place them
- Inbound ACLs filter before routing, so dropped packets never waste a route lookup.
- Outbound ACLs filter after routing, useful when traffic from several interfaces leaves through one.
- Extended ACLs: close to the source, so unwanted traffic is dropped before it crosses the network.
- Standard ACLs: close to the destination, because they only know the source; placed near the source they would block that host from everywhere.
Configuration and guidelines
! standard: only the admin subnet may manage the router
ip access-list standard MGMT-ONLY
permit 192.168.99.0 0.0.0.255
line vty 0 4
access-class MGMT-ONLY in
! extended, named: staff may browse the web and use DNS only
ip access-list extended STAFF-OUT
permit tcp 192.168.10.0 0.0.0.255 any eq 443
permit tcp 192.168.10.0 0.0.0.255 any eq 80
permit udp 192.168.10.0 0.0.0.255 any eq 53
deny ip any any log
interface gigabitEthernet 0/1
ip access-group STAFF-OUT in- One ACL per protocol, per direction, per interface.
- Use ACLs on border routers and between internal zones.
- Document every ACL and add remarks; test in a lab first.
- Apply remotely with care: a mistake can lock you out. Schedule a reload or keep console access ready.
Real-world example: keeping pupils away from the admin network
A secondary school's management information system server holds pupil records and sits in the staff server VLAN. A penetration test showed that a laptop in the pupil VLAN could reach the server's login page. The network team wrote an extended ACL and applied it inbound on the pupil VLAN's interface on the core switch, close to the source as good practice suggests.
The ACL first permits DNS to the school's resolvers and web traffic to the content filter, then denies any traffic from the pupil range to the staff and server ranges, then permits the remaining traffic to the internet. A final explicit deny with logging records anything unexpected. A remark line explains each entry, and the change was tested from a pupil laptop before the start of term.
Practice
An ACL contains only deny lines. What happens to all other traffic?
Where should an extended ACL go, and why?
Which number range is an extended ACL: 10 or 110?
Key takeaways
- ACLs are ordered rules; the first match wins.
- Every ACL ends with an implicit deny any.
- Standard = source only (place near destination); extended = many fields (place near source).
- Prefer named ACLs and document them.
- One ACL per protocol, per direction, per interface.
Original content written by Mohamed Fayas for FM TecHub. © 2026 FM TecHub. You're welcome to share a link to this page; please don't copy the text elsewhere without permission.