Access Control Lists

What it is

An access control list (ACL) is an ordered list of permit and deny rules that a router applies to packets.

ACLs filter traffic on interfaces, and they also identify traffic for other features, such as NAT, route maps and QoS. The router reads the list from the top and acts on the first rule that matches. If nothing matches, an implicit deny at the end drops the packet.

How it works

Rules match fields in the packet, and the list is applied in one direction on an interface.

Types of ACL

Named ACLs are easier to read and to edit, so they are the usual choice today.

Wildcard masks

ACLs use a wildcard mask, which is the inverse of a subnet mask. A zero bit means the bit must match, and a one bit means it is ignored.

The keyword host stands for a wildcard of 0.0.0.0, and any stands for 0.0.0.0 with 255.255.255.255.

Building an extended named ACL

R1(config)# ip access-list extended WEB-ONLY
R1(config-ext-nacl)# remark Allow web to the server
R1(config-ext-nacl)# permit tcp 10.1.1.0 0.0.0.255 host 192.0.2.10 eq 443
R1(config-ext-nacl)# permit tcp 10.1.1.0 0.0.0.255 host 192.0.2.10 eq 80
R1(config-ext-nacl)# deny ip any any log

The last line is not strictly needed, since the implicit deny exists. Writing it with log lets you see the counts and the log of packets that were dropped.

Building a standard ACL

R1(config)# ip access-list standard MGMT-HOSTS
R1(config-std-nacl)# permit 10.99.0.0 0.0.0.255

Applying an ACL

R1(config)# interface GigabitEthernet0/1
R1(config-if)# ip access-group WEB-ONLY in

The direction is from the router's point of view. in filters packets as they enter the interface, and out filters packets as they leave. You can apply one ACL per protocol, per direction, per interface.

Placement

The common rule has two parts.

• Put extended ACLs close to the source, so unwanted traffic is dropped early.
• Put standard ACLs close to the destination, because they match only the source and could block too much if placed near it.

Editing

Every rule has a sequence number, and the default step is 10. This lets you insert a rule without retyping the list.

R1(config)# ip access-list extended WEB-ONLY
R1(config-ext-nacl)# 15 permit tcp 10.1.1.0 0.0.0.255 host 192.0.2.10 eq 8080
R1(config-ext-nacl)# no 20
R1# show access-lists WEB-ONLY
R1(config)# ip access-list resequence WEB-ONLY 10 10

A new rule with a sequence number goes in that position. The command no 20 removes rule 20.

Without a sequence number, a new rule goes to the end. Rule order matters, so a broad rule early can hide a specific rule later.

Useful options

IPv6 ACLs

IPv6 ACLs are always named, and they are applied with a different command.

R1(config)# ipv6 access-list V6-FILTER
R1(config-ipv6-acl)# permit tcp 2001:db8:1::/64 host 2001:db8:2::10 eq 443
R1(config-ipv6-acl)# deny ipv6 any any log
R1(config)# interface GigabitEthernet0/1
R1(config-if)# ipv6 traffic-filter V6-FILTER in

At the end of every IPv6 ACL there are implicit rules that permit neighbour discovery before the implicit deny. This matters because IPv6 needs neighbour discovery to work.

Verifying

R1# show access-lists
R1# show ip access-lists WEB-ONLY
R1# show ip interface GigabitEthernet0/1

show access-lists lists each rule with a count of matches. A rule with no matches may be in the wrong order, or the traffic may not be arriving. show ip interface shows which ACL is applied in each direction.

An outbound ACL does not filter traffic that the router itself creates. To filter access to the router lines, use access-class, as in the device access page.