An Access Control List (ACL) is one of the most fundamental firewall-like tools on Cisco equipment — a set of rules specifying which traffic is allowed through and which should be blocked. In this tutorial, we'll build a real Standard ACL that only allows a specific subnet access to part of the network.
What is a Standard ACL, and what's its limitation?
A Standard ACL only makes decisions based on the source IP address — it can't filter by destination, port, or protocol (for that, you'd need an Extended ACL). Because of this, a Standard ACL should be configured as close as possible to the traffic's destination (not source), to avoid unintended side effects elsewhere on the network.
This tutorial's scenario
Let's say we want to allow only computers in the IT subnet (192.168.10.0/24) to access the management server, and block the rest of the network.
Step 1: Enter configuration mode
enable
configure terminal
Step 2: Define the ACL rules
access-list 10 permit 192.168.10.0 0.0.0.255
access-list 10 deny any
Important note about wildcard masks: instead of a normal subnet mask (255.255.255.0), Cisco ACLs use a wildcard mask, which is its inverse (0.0.0.255) — a zero means "this part of the address must match exactly" and 255 means "any value is acceptable."
Also important: at the end of every ACL, there's an invisible, implicit deny any all rule by default — which is exactly why you must define the needed permit rules before it, and rules are evaluated top to bottom (first match wins).
Step 3: Apply the ACL to an interface
An ACL has no effect on its own until it's applied to an interface, in a specific direction (inbound or outbound):
interface fastEthernet 0/1
ip access-group 10 in
exit
The in keyword means this ACL is checked against traffic entering this interface.
Step 4: Verify the rules
show access-lists
This command shows all configured ACLs and how many packets each rule has matched so far (match count) — a very useful tool for confirming the ACL is actually working.
Step 5: Practical test
From a computer in the 192.168.10.0/24 subnet, ping the server — you should get a reply. Repeat the test from a computer in a different subnet — you should get Request Timed Out.
Why is ACL an essential security skill?
ACLs are the most fundamental layer of access control in any enterprise network — before dedicated firewalls even come into play, these simple rules on a router or switch are the first line of defense against unauthorized access between different parts of the network. This is exactly one of the core skills in my CCNA and network security courses.
Blog