Standard ACL Configuration Commands Explained

You can use either a name or a number to create a standard access list. If you use a number, it is called a numbered standard access list. If you use a name, it is called a named standard access list. No matter which option you choose to create an ACL, it works the same way. The only advantage of a named ACL over a numbered ACL is that it allows you to edit entries. You can edit an entry in a named ACL, but not in a numbered ACL. This tutorial explains how to create, implement, and manage numbered ACLs.

Lab setup

Either create a Packet Tracer lab as shown in the following image, or download the pre-created lab and load it into Packet Tracer.

Download Packet Tracer Lab with Initial Configuration

This network has three segments.

This network has no ACL. All segments can reach each other. You can use the ping command to test connectivity between these segments. The following image verifies connectivity between PC0 of the Students segment and Server0 of the Server segment.

Objectives

Create and implement an ACL that serves the following purposes.

• Allow the Students segment to access the Teachers segment.
• Block the Students segment to access the Server segment.
• Allow the Teachers segment to access the Students and server segments.

Creating a standard ACL

Access the router's CLI prompt and run the following commands.

Router>enable
Router#configure terminal
Router(config)#access-list 10 deny 10.0.0.0 0.255.255.255
Router(config)#access-list 10 permit 20.0.0.0 0.255.255.255
Router(config)#

You can create an access list only in global configuration mode. The first two commands enter global configuration mode. The following two commands create a standard access list with two statements. The first statement denies all traffic from the network 10.0.0.0. The second statement allows all traffic from the network 20.0.0.0. The ACL uses the number 10 as the identification.

Implementing the ACL

An ACL works only when you apply it to an interface. To use this ACL, you must apply it to the proper interface in the correct direction.

Which interface and direction is correct for this ACL?

This ACL will work properly if you apply it to GigabitEthernet0/2 in the outward direction. It is the last exit point for the traffic originating from the network 10.0.0.0. You should use a standard ACL on the last exit point. This practice allows the source to communicate with other parts of the network. The following commands apply this ACL to the GigabitEthernet0/2 in the outward direction.

Router(config)#interface gigabitEthernet 0/2
Router(config-if)#ip access-group 10 out

After this ACL, the router takes the following steps before sending each packet out from GigabitEthernet0/2.

• It will check the packet's source address.
• If it belongs to the network 10.0.0.0, it drops the packet.
• If it belongs to the network 20.0.0.0, it allows the packet.
• If it belongs to another network, it drops the packet.

The following image verifies that the Students segment cannot access the Server segment after the ACL is applied.

The following image verifies that the Teachers segment can still access the Students and Server segments even after the ACL is applied.

The show ip access-lists command

The 'show ip access-lists' command displays the entries of the ACLs. It also shows the number of packets matched with each entry. The following image shows the output of this command.

Configured lab

The following link provides the configured Packet Tracer lab for this example.

Packet Tracer Lab with ACL implementation

Conclusion

Creating and implementing standard access lists is a crucial step in managing network traffic and enhancing security. This tutorial demonstrated how to create, implement, and verify a standard numbered ACL to allow specific access between network segments while blocking unauthorized traffic. Learning it helps you preserve the integrity of network resources and also optimizes network performance by managing traffic flow efficiently.