How to Configure a Standard Access Control List (ACL): A Step-by-Step Guide
Access Control Lists (ACLs) are the unsung heroes of network security. Acting as your router’s digital security guards, they inspect incoming and outgoing traffic to either permit or deny data packets based on specific rules. [1]
In this tutorial, you will learn how to configure a Standard ACL on a Cisco router. We will cover the core concepts, map out the topology, write the commands, and apply the rules to the correct interface. [1, 2]
What is a Standard ACL?
A Standard ACL is a basic network filter that makes blocking or allowing decisions strictly based on the Source IP address of the traffic. [1, 2]
- Identification: They are assigned a number between 1 to 99 or 1300 to 1999.
- Placement Rule: They should always be placed as close to the destination as possible.
- The Implicit Deny: Remember that every ACL has an invisible
deny anyrule at the very end. If you don’t explicitly allow a packet, it gets dropped! [1]
The Network Scenario
Before diving into the command line, let’s look at the topology layout for this demonstration:
text
[ Management LAN ] ─── ( 10.0.0.0/24 ) ───┐
├─── [ Router R1 ] ─── [ Server S1 ]
[ Guest LAN ] ────── ( 192.168.1.0/24 ) ─┘ (172.16.0.5)
Use code with caution.
Goal: We want to allow traffic from the Management LAN (10.0.0.0/24) to access Server S1 (172.16.0.5), but completely block the Guest LAN (192.168.1.0/24) from reaching it. [1]
Step-by-Step Configuration Guide
Step 1: Log in to the Router and Enter Global Configuration Mode
Connect to your router using your preferred terminal application (like PuTTY or SecureCRT). Navigate past the user execution prompt into the privileged executive mode, and then enter global configuration. [1]
bash
R1> enable
R1# configure terminal
R1(config)#
Use code with caution.
Image placeholder: Screenshot showing the router prompt switching to R1(config)# mode.
Step 2: Create the Standard ACL Rule
We will create an access list using the number 1. First, we write the rule to permit the Management LAN subnet. We use a wildcard mask (0.0.0.255) to specify the entire /24 network range. [1]
bash
R1(config)# access-list 1 permit 10.0.0.0 0.0.0.255
Use code with caution.
Image placeholder: Terminal output demonstrating the ‘access-list 1 permit’ syntax execution.
(Note: Because of the implicit deny at the end of the list, we do not need to explicitly write a deny statement for the Guest LAN—it will be automatically blocked!) [1]
Step 3: Select the Outbound Interface
Standard ACLs must be placed closest to the destination. In our scenario, the destination is Server S1, which sits off interface GigabitEthernet 0/1. Let’s move into that interface configuration mode:
bash
R1(config)# interface GigabitEthernet 0/1
R1(config-if)#
Use code with caution.
Step 4: Apply the ACL to the Interface
Now, link your access list to the interface using the ip access-group command. Because the traffic is filtered as it leaves the router interface toward the server, we use the out parameter. [1]
bash
R1(config-if)# ip access-group 1 out
R1(config-if)# exit
R1(config)# exit
Use code with caution.
Image placeholder: Interface configuration text indicating the application of ‘ip access-group 1 out’.
Step 5: Verify the ACL Configuration
Always verify your implementation. Run the show access-lists command to check the statements and see if the router is actively matching packets against your rules.
bash
R1# show access-lists
Standard IP access list 1
10 permit 10.0.0.0, wildcard bits 0.0.0.255
Use code with caution.
Image placeholder: The output of the ‘show access-lists’ command displaying active rules and match counters.
Quick Reference: Inbound vs. Outbound ACLs
| Direction | Where Traffic is Filtered | Best Practice Use Case |
|---|---|---|
Inbound (in) | Filtered before entering the router. | Saves router CPU cycles if you want to drop bad traffic immediately. |
Outbound (out) | Filtered after routing, as it exits. | Mandatory for Standard ACLs to prevent accidentally blocking traffic destined for other networks. |
By implementing these rules properly, you ensure your essential internal infrastructure stays reachable only by authorized subnets while maintaining security bounds across your network environments.
If you plan to publish this directly to your site, let me know:
- Do you want to add an Extended ACL section to filter by specific ports (like HTTP or SSH)?
- What WordPress page builder (e.g., Gutenberg, Elementor) are you using so I can format the image layout instructions accordingly?