Basic Network Security Concepts · Topic 6 of 7
Access Control Lists and Firewalls
Learn how ACLs and firewalls filter traffic, how rules are processed top down with an implicit deny, and the main firewall types explained simply.
- 5 min
- An ACL is an ordered list of permit and deny rules.
- Rules are read top to bottom and the first match wins.
- Every ACL ends with an implicit deny.
What it is
Access control lists and firewalls decide which network traffic is allowed and which is blocked.
An ACL (access control list) is an ordered list of permit and deny rules. A firewall is a device or program that enforces such rules between networks.
This page explains how the rules are read, shows a short Cisco IOS example, and compares the main types of firewall.
How it works
A device reads the rules in order and acts on the first rule that matches.
How an ACL is processed
Each rule says permit or deny, and describes the traffic by items such as source address, destination address, protocol and port.
- Rules are checked from top to bottom.
- The first match wins, and no further rules are read.
- At the end of every ACL there is an implicit deny, so traffic that matches no rule is dropped.
- Order matters, so specific rules go before general ones.
Because of the implicit deny, an ACL with only deny rules blocks everything. You need at least one permit rule for traffic that should pass.
ACL types on Cisco IOS
| Type | Matches on | Typical number range |
|---|---|---|
| Standard | Source address only | 1 to 99 |
| Extended | Source, destination, protocol and port | 100 to 199 |
Other number ranges exist, and named ACLs do the same job with a name instead of a number. An ACL has no effect until it is applied to an interface in a direction, in or out.
R1(config)# ip access-list extended WEB-ONLY
R1(config-ext-nacl)# permit tcp 192.168.1.0 0.0.0.255 any eq 80
R1(config-ext-nacl)# permit tcp 192.168.1.0 0.0.0.255 any eq 443
R1(config-ext-nacl)# exit
R1(config)# interface GigabitEthernet0/1
R1(config-if)# ip access-group WEB-ONLY inThis example, on IOS or IOS XE, allows hosts in 192.168.1.0/24 to open web connections on TCP ports 80 and 443. Everything else from that network is dropped by the implicit deny. The 0.0.0.255 is a wildcard mask, which is the reverse of a subnet mask.
R1# show access-listsThe show access-lists command lists the rules and how many packets matched each one.
Firewall types
| Type | How it decides | Notes |
|---|---|---|
| Packet filter | Looks at each packet alone, using addresses and ports | Simple and fast, but has no memory of connections |
| Stateful firewall | Tracks connections and allows replies to traffic that was sent out | Common today |
| Application layer or proxy firewall | Understands the application data | Slower but can block by content |
| Next generation firewall (NGFW) | Stateful plus application awareness, intrusion prevention and more | Used at the network edge |
A stateful firewall keeps a table of active connections. Returning traffic that belongs to a known connection is allowed automatically, and unrequested incoming traffic is blocked.
Firewalls can be network firewalls, which sit between networks, or host based firewalls, which run on one computer. The two work well together as layers.
A good firewall policy follows least privilege. Block everything by default, then allow only what is needed.
ACL or firewall
An ACL on a router is a basic filter, and it normally looks at packets one at a time. A dedicated firewall adds connection tracking and more inspection. For a small design, both can be used, with an ACL at the router and a firewall at the edge.
What to remember for the exam
Seven facts cover most questions on this topic.
- An ACL is an ordered list of permit and deny rules.
- Rules are read top to bottom and the first match wins.
- Every ACL ends with an implicit deny.
- Standard ACLs match source only, and extended ACLs match more fields.
- An ACL must be applied to an interface with
ip access-groupto work. - A stateful firewall tracks connections and allows return traffic.
- An NGFW adds application awareness and intrusion prevention.
If a question shows a deny rule below a broader permit rule for the same traffic, the permit wins because it matches first.
Common mistakes
These four errors are common.
Putting a general rule first. A broad permit above a specific deny means the deny is never reached.
Forgetting the implicit deny. A new ACL with one deny rule and no permit blocks all traffic.
Writing an ACL but not applying it. Without ip access-group on an interface, nothing is filtered.
Using a subnet mask instead of a wildcard mask. IOS ACLs use wildcard masks, such as 0.0.0.255 for a /24.
Be careful when you apply an ACL to the interface you use to manage a device. A wrong rule can lock you out.
Check yourself
Work through these three questions.
What happens to traffic that matches no rule in an ACL?
It is dropped by the implicit deny at the end of the list.
How is a stateful firewall different from a simple packet filter?
A stateful firewall tracks connections and allows return traffic for them. A packet filter looks at each packet alone.
Which command applies a named ACL to an interface on IOS?
ip access-group NAME inoroutin interface configuration mode, which sets the direction it filters.
Topic 6 of 7 in Basic Network Security Concepts
Test yourself on Basic Network Security Concepts
The full Cisco CCST 100-160 Cybersecurity question bank has 864 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Cisco. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.