{"id":101,"date":"2026-08-26T12:35:18","date_gmt":"2026-08-26T12:35:18","guid":{"rendered":"https:\/\/wordpress.sarservice.site\/?p=101"},"modified":"2026-08-26T12:35:27","modified_gmt":"2026-08-26T12:35:27","slug":"how-to-configure-acl-in-cisco-router-step-by-step-guide","status":"publish","type":"post","link":"https:\/\/wordpress.sarservice.site\/index.php\/2026\/08\/26\/how-to-configure-acl-in-cisco-router-step-by-step-guide\/","title":{"rendered":"How to Configure ACL in Cisco Router \u2013 Step-by-Step Guide"},"content":{"rendered":"\n<h1 class=\"wp-block-heading\"><\/h1>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Category:<\/strong> Cisco Networking | <strong>Level:<\/strong> Beginner to Intermediate<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Introduction<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">An <strong>Access Control List (ACL)<\/strong> is one of the most important security features available on Cisco routers. ACLs are used to <strong>permit or deny network traffic<\/strong> based on rules such as source IP address, destination IP address, protocol, and port number.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">In this tutorial, we will learn how to configure ACL on a Cisco router step by step, including <strong>Standard ACL and Extended ACL<\/strong> examples.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What is ACL?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">ACL stands for <strong>Access Control List<\/strong>. It is a list of rules that a Cisco router uses to decide whether network traffic should be allowed or blocked.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">There are two commonly used types:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Standard ACL:<\/strong> Filters traffic primarily based on the <strong>source IP address<\/strong>.<\/li>\n\n\n\n<li><strong>Extended ACL:<\/strong> Filters traffic based on <strong>source IP, destination IP, protocol, and port number<\/strong>.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">How ACL works<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">When a packet reaches an interface where an ACL is applied, the router checks the ACL rules from <strong>top to bottom<\/strong>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The first matching rule is applied.<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p class=\"wp-block-paragraph\"><strong>Important:<\/strong> Cisco ACLs have an implicit <code>deny<\/code> at the end. If traffic does not match a permit statement, it will be denied.<\/p>\n<\/blockquote>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">Example Network Topology<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">We will use this simple topology:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>PC\n192.168.1.10\n    |\n    | G0\/0\n    |\n+-----------+\n|   R1      |\n|   Cisco   |\n+-----------+\n    |\n    | G0\/1\n    |\n  Internet\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Example network:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>LAN:       192.168.1.0\/24\nRouter G0\/0: 192.168.1.1\nRouter G0\/1: Internet\/WAN\n<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Part 1: Configure a Standard ACL<\/h1>\n\n\n\n<h3 class=\"wp-block-heading\">Scenario<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Suppose we want to <strong>block the entire 192.168.1.0\/24 network<\/strong> from reaching traffic through Router R1&#8217;s G0\/1 interface.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Step 1: Enter privileged mode<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>Router&gt; enable\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">Step 2: Enter global configuration mode<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>Router# configure terminal\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">Step 3: Create the Standard ACL<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>Router(config)# access-list 10 deny 192.168.1.0 0.0.0.255\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Here:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><code>10<\/code> = ACL number<\/li>\n\n\n\n<li><code>deny<\/code> = block traffic<\/li>\n\n\n\n<li><code>192.168.1.0<\/code> = source network<\/li>\n\n\n\n<li><code>0.0.0.255<\/code> = wildcard mask<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Step 4: Permit other traffic<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>Router(config)# access-list 10 permit any\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">This allows all other traffic.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Step 5: Enter the interface<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>Router(config)# interface gigabitEthernet 0\/1\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">Step 6: Apply the ACL<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>Router(config-if)# ip access-group 10 out\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">The keyword <code>out<\/code> means the ACL is applied to traffic <strong>leaving the interface<\/strong>.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Step 7: Exit and save the configuration<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>Router(config-if)# end\nRouter# write memory\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">You can also use:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Router# copy running-config startup-config\n<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Part 2: Configure an Extended ACL<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">Extended ACLs provide much more control than Standard ACLs.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Scenario<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Suppose we want to:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Allow HTTP traffic on port <strong>80<\/strong><\/li>\n\n\n\n<li>Allow HTTPS traffic on port <strong>443<\/strong><\/li>\n\n\n\n<li>Block other IP traffic from the LAN<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Step 1: Create the Extended ACL<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>Router(config)# access-list 101 permit tcp 192.168.1.0 0.0.0.255 any eq 80\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">This permits HTTP traffic.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Next:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Router(config)# access-list 101 permit tcp 192.168.1.0 0.0.0.255 any eq 443\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">This permits HTTPS traffic.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Then deny other IP traffic:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Router(config)# access-list 101 deny ip 192.168.1.0 0.0.0.255 any\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">Step 2: Apply the ACL to the interface<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>Router(config)# interface gigabitEthernet 0\/1\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Then:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Router(config-if)# ip access-group 101 out\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">Step 3: Save the configuration<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>Router(config-if)# end\nRouter# copy running-config startup-config\n<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">How to Verify ACL Configuration<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">After configuring an ACL, always verify it.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Display ACLs<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>Router# show access-lists\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">or:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Router# show ip access-lists\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">Check the interface<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>Router# show ip interface gigabitEthernet 0\/1\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">This helps confirm whether an ACL is applied inbound or outbound.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">View the complete configuration<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>Router# show running-config\n<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Understanding Wildcard Masks<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">Wildcard masks are very important when configuring Cisco ACLs.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For example:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Network:       192.168.1.0\nSubnet Mask:   255.255.255.0\nWildcard Mask: 0.0.0.255\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">The wildcard mask is basically the inverse of the subnet mask.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>255.255.255.255\n-255.255.255.0\n----------------\n  0.0.0.255\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Therefore:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>access-list 10 deny 192.168.1.0 0.0.0.255\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">means <strong>deny traffic from the entire 192.168.1.0\/24 network<\/strong>.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Important ACL Rules to Remember<\/h1>\n\n\n\n<h3 class=\"wp-block-heading\">1. ACLs are processed from top to bottom<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">For example:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>access-list 10 deny host 192.168.1.10\naccess-list 10 permit 192.168.1.0 0.0.0.255\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">The first rule blocks <code>192.168.1.10<\/code>, while the second rule allows the rest of the network.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">2. Order matters<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">If you put a broad <code>permit<\/code> rule before a specific <code>deny<\/code>, the deny rule may never be reached.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">3. Implicit deny<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Every ACL effectively ends with:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>deny any\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Therefore, if you want other traffic to pass, explicitly use:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>permit any\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">4. Standard ACL placement<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">As a general rule, Standard ACLs are placed <strong>closer to the destination<\/strong> because they filter only by source address.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">5. Extended ACL placement<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Extended ACLs are generally placed <strong>closer to the source<\/strong> because they can filter traffic more specifically.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Useful ACL Commands<\/h1>\n\n\n\n<pre class=\"wp-block-code\"><code>show access-lists\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Display configured ACLs.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>show ip access-lists\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Display IP ACL entries.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>show running-config\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Display the current router configuration.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>show ip interface g0\/1\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Check ACLs applied to an interface.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">To remove an ACL:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Router(config)# no access-list 10\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">To remove an ACL from an interface:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Router(config-if)# no ip access-group 10 out\n<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Conclusion<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">Cisco ACLs are an essential part of network security. They allow network administrators to control which traffic can enter or leave a router interface.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For beginners, remember these three things:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>Standard ACL \u2192 mainly source IP filtering<\/strong><\/li>\n\n\n\n<li><strong>Extended ACL \u2192 source, destination, protocol and port filtering<\/strong><\/li>\n\n\n\n<li><strong>ACL rules are processed from top to bottom, with an implicit deny at the end<\/strong><\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">Practice these configurations in <strong>Cisco Packet Tracer<\/strong> before applying ACLs to a production network.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Recommended SEO title:<\/strong><br><strong>How to Configure ACL in Cisco Router Step by Step | Standard &amp; Extended ACL<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Suggested URL slug:<\/strong><br><code>\/configure-acl-cisco-router-step-by-step\/<\/code><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Suggested meta description:<\/strong><br>Learn how to configure Standard and Extended ACL on a Cisco router step by step with practical commands, wildcard masks, interface configuration, verification commands, and examples.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Category: Cisco Networking | Level: Beginner to Intermediate Introduction An Access Control List (ACL) is one of the most important security features available on Cisco routers. ACLs are used to &hellip; <a href=\"https:\/\/wordpress.sarservice.site\/index.php\/2026\/08\/26\/how-to-configure-acl-in-cisco-router-step-by-step-guide\/\" class=\"more-link\">Read More<\/a><\/p>\n","protected":false},"author":1,"featured_media":102,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-101","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-sarservice","entry"],"_links":{"self":[{"href":"https:\/\/wordpress.sarservice.site\/index.php\/wp-json\/wp\/v2\/posts\/101","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wordpress.sarservice.site\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/wordpress.sarservice.site\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/wordpress.sarservice.site\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/wordpress.sarservice.site\/index.php\/wp-json\/wp\/v2\/comments?post=101"}],"version-history":[{"count":0,"href":"https:\/\/wordpress.sarservice.site\/index.php\/wp-json\/wp\/v2\/posts\/101\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/wordpress.sarservice.site\/index.php\/wp-json\/wp\/v2\/media\/102"}],"wp:attachment":[{"href":"https:\/\/wordpress.sarservice.site\/index.php\/wp-json\/wp\/v2\/media?parent=101"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/wordpress.sarservice.site\/index.php\/wp-json\/wp\/v2\/categories?post=101"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/wordpress.sarservice.site\/index.php\/wp-json\/wp\/v2\/tags?post=101"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}