{"id":109,"date":"2026-10-03T09:43:22","date_gmt":"2026-10-03T09:43:22","guid":{"rendered":"https:\/\/wordpress.sarservice.site\/?p=109"},"modified":"2026-10-03T09:43:33","modified_gmt":"2026-10-03T09:43:33","slug":"how-to-configure-a-standard-access-control-list-acl-a-step-by-step-guide","status":"publish","type":"post","link":"https:\/\/wordpress.sarservice.site\/index.php\/2026\/10\/03\/how-to-configure-a-standard-access-control-list-acl-a-step-by-step-guide\/","title":{"rendered":"How to Configure a Standard Access Control List (ACL): A Step-by-Step Guide"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\"><strong>Access Control Lists (ACLs)<\/strong> are the unsung heroes of network security. Acting as your router&#8217;s digital security guards, they inspect incoming and outgoing traffic to either permit or deny data packets based on specific rules. [<a href=\"https:\/\/www.computernetworkingnotes.com\/ccna-study-guide\/configure-standard-access-control-list-step-by-step-guide.html\">1<\/a>]<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">In this tutorial, you will learn how to configure a <strong>Standard ACL<\/strong> on a Cisco router. We will cover the core concepts, map out the topology, write the commands, and apply the rules to the correct interface. [<a href=\"https:\/\/study-ccna.com\/configuring-standard-acls\/\">1<\/a>, <a href=\"https:\/\/www.computernetworkingnotes.com\/ccna-study-guide\/configure-standard-access-control-list-step-by-step-guide.html\">2<\/a>]<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<p class=\"wp-block-paragraph\">What is a Standard ACL?<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A <strong>Standard ACL<\/strong> is a basic network filter that makes blocking or allowing decisions <strong>strictly based on the Source IP address<\/strong> of the traffic. [<a href=\"https:\/\/www.computernetworkingnotes.com\/ccna-study-guide\/configure-standard-access-control-list-step-by-step-guide.html\">1<\/a>, <a href=\"https:\/\/study-ccna.com\/configuring-standard-acls\/\">2<\/a>]<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Identification:<\/strong> They are assigned a number between <strong>1 to 99<\/strong> or <strong>1300 to 1999<\/strong>.<\/li>\n\n\n\n<li><strong>Placement Rule:<\/strong> They should always be placed <strong>as close to the destination<\/strong> as possible.<\/li>\n\n\n\n<li><strong>The Implicit Deny:<\/strong> Remember that every ACL has an invisible <code>deny any<\/code> rule at the very end. If you don&#8217;t explicitly allow a packet, it gets dropped! [<a href=\"https:\/\/study-ccna.com\/configuring-standard-acls\/\">1<\/a>]<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<p class=\"wp-block-paragraph\">The Network Scenario<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Before diving into the command line, let&#8217;s look at the topology layout for this demonstration:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">text<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"> <code> [ Management LAN ] \u2500\u2500\u2500 ( 10.0.0.0\/24 ) \u2500\u2500\u2500\u2510\n                                            \u251c\u2500\u2500\u2500 [ Router R1 ] \u2500\u2500\u2500 [ Server S1 ]\n  [ Guest LAN ] \u2500\u2500\u2500\u2500\u2500\u2500  ( 192.168.1.0\/24 ) \u2500\u2518                      (172.16.0.5)\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Use code with caution.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Goal:<\/strong> We want to allow traffic from the <strong>Management LAN (10.0.0.0\/24)<\/strong> to access <strong>Server S1 (172.16.0.5)<\/strong>, but completely block the <strong>Guest LAN (192.168.1.0\/24)<\/strong> from reaching it. [<a href=\"https:\/\/study-ccna.com\/configuring-standard-acls\/\">1<\/a>]<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<p class=\"wp-block-paragraph\">Step-by-Step Configuration Guide<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Step 1: Log in to the Router and Enter Global Configuration Mode<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Connect to your router using your preferred terminal application (like PuTTY or SecureCRT). Navigate past the user execution prompt into the privileged executive mode, and then enter global configuration. [<a href=\"https:\/\/study-ccna.com\/configuring-standard-acls\/\">1<\/a>]<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">bash<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>R1&gt; enable\nR1# configure terminal\nR1(config)#\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Use code with caution.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>Image placeholder: Screenshot showing the router prompt switching to R1(config)# mode.<\/em><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Step 2: Create the Standard ACL Rule<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">We will create an access list using the number <strong>1<\/strong>. First, we write the rule to permit the Management LAN subnet. We use a wildcard mask (<code>0.0.0.255<\/code>) to specify the entire <code>\/24<\/code> network range. [<a href=\"https:\/\/study-ccna.com\/configuring-standard-acls\/\">1<\/a>]<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">bash<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>R1(config)# access-list 1 permit 10.0.0.0 0.0.0.255\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Use code with caution.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>Image placeholder: Terminal output demonstrating the &#8216;access-list 1 permit&#8217; syntax execution.<\/em><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>(Note: Because of the implicit deny at the end of the list, we do not need to explicitly write a deny statement for the Guest LAN\u2014it will be automatically blocked!)<\/em> [<a href=\"https:\/\/study-ccna.com\/configuring-standard-acls\/\">1<\/a>]<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Step 3: Select the Outbound Interface<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Standard ACLs must be placed closest to the destination. In our scenario, the destination is Server S1, which sits off interface <strong>GigabitEthernet 0\/1<\/strong>. Let&#8217;s move into that interface configuration mode:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">bash<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>R1(config)# interface GigabitEthernet 0\/1\nR1(config-if)#\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Use code with caution.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Step 4: Apply the ACL to the Interface<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Now, link your access list to the interface using the <code>ip access-group<\/code> command. Because the traffic is filtered as it <strong>leaves<\/strong> the router interface toward the server, we use the <code>out<\/code> parameter. [<a href=\"https:\/\/study-ccna.com\/configuring-standard-acls\/\">1<\/a>]<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">bash<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>R1(config-if)# ip access-group 1 out\nR1(config-if)# exit\nR1(config)# exit\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Use code with caution.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>Image placeholder: Interface configuration text indicating the application of &#8216;ip access-group 1 out&#8217;.<\/em><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Step 5: Verify the ACL Configuration<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Always verify your implementation. Run the <code>show access-lists<\/code> command to check the statements and see if the router is actively matching packets against your rules.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">bash<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>R1# show access-lists\nStandard IP access list 1\n    10 permit 10.0.0.0, wildcard bits 0.0.0.255\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Use code with caution.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>Image placeholder: The output of the &#8216;show access-lists&#8217; command displaying active rules and match counters.<\/em><\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<p class=\"wp-block-paragraph\">Quick Reference: Inbound vs. Outbound ACLs<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><tbody><tr><th>Direction<\/th><th>Where Traffic is Filtered<\/th><th>Best Practice Use Case<\/th><\/tr><tr><td><strong>Inbound (<code>in<\/code>)<\/strong><\/td><td>Filtered <em>before<\/em> entering the router.<\/td><td>Saves router CPU cycles if you want to drop bad traffic immediately.<\/td><\/tr><tr><td><strong>Outbound (<code>out<\/code>)<\/strong><\/td><td>Filtered <em>after<\/em> routing, as it exits.<\/td><td>Mandatory for <strong>Standard ACLs<\/strong> to prevent accidentally blocking traffic destined for other networks.<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">By implementing these rules properly, you ensure your essential internal infrastructure stays reachable only by authorized subnets while maintaining security bounds across your network environments.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If you plan to publish this directly to your site, let me know:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Do you want to add an <strong>Extended ACL<\/strong> section to filter by specific ports (like HTTP or SSH)?<\/li>\n\n\n\n<li>What <strong>WordPress page builder<\/strong> (e.g., Gutenberg, Elementor) are you using so I can format the image layout instructions accordingly?<\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>Access Control Lists (ACLs) are the unsung heroes of network security. Acting as your router&#8217;s digital security guards, they inspect incoming and outgoing traffic to either permit or deny data &hellip; <a href=\"https:\/\/wordpress.sarservice.site\/index.php\/2026\/10\/03\/how-to-configure-a-standard-access-control-list-acl-a-step-by-step-guide\/\" class=\"more-link\">Read More<\/a><\/p>\n","protected":false},"author":1,"featured_media":110,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-109","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-sarservice","entry"],"_links":{"self":[{"href":"https:\/\/wordpress.sarservice.site\/index.php\/wp-json\/wp\/v2\/posts\/109","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wordpress.sarservice.site\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/wordpress.sarservice.site\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/wordpress.sarservice.site\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/wordpress.sarservice.site\/index.php\/wp-json\/wp\/v2\/comments?post=109"}],"version-history":[{"count":1,"href":"https:\/\/wordpress.sarservice.site\/index.php\/wp-json\/wp\/v2\/posts\/109\/revisions"}],"predecessor-version":[{"id":111,"href":"https:\/\/wordpress.sarservice.site\/index.php\/wp-json\/wp\/v2\/posts\/109\/revisions\/111"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/wordpress.sarservice.site\/index.php\/wp-json\/wp\/v2\/media\/110"}],"wp:attachment":[{"href":"https:\/\/wordpress.sarservice.site\/index.php\/wp-json\/wp\/v2\/media?parent=109"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/wordpress.sarservice.site\/index.php\/wp-json\/wp\/v2\/categories?post=109"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/wordpress.sarservice.site\/index.php\/wp-json\/wp\/v2\/tags?post=109"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}