ACLs explained: wildcard masks and order

Standard or extended: the choice that starts every ACL question

An access control list (ACL) is an ordered list of permit and deny statements that a router applies to packets on an interface, in one direction. A standard ACL matches only the source address; an extended ACL matches source, destination, protocol and port numbers. The decision rule: if the requirement names only who the traffic comes from, use standard; the moment it mentions a destination, a protocol or a port, you need extended. Whichever you use, the router checks entries top to bottom, the first match decides, and an invisible deny any waits at the end.

The number ranges are from Cisco’s ACL configuration guide. Named ACLs (ip access-list standard NAME or extended NAME) have the same behaviour and allow editing by sequence number.

Wildcard masks, computed

A wildcard mask is the inverse of a subnet mask: a 0 bit must match, a 1 bit is ignored. To get it, subtract each octet of the subnet mask from 255.

• /24 (255.255.255.0) gives 0.0.0.255.
• /27 (255.255.255.224) gives 0.0.0.31. So 192.168.10.64 0.0.0.31 matches 192.168.10.64 through 192.168.10.95: the block size is 32 and the wildcard is always block size minus 1.
• /20 (255.255.240.0) gives 0.0.15.255. So 172.16.32.0 0.0.15.255 matches 172.16.32.0 through 172.16.47.255.
• A single host is 0.0.0.0, written host 10.1.1.5; every address is any, which means 0.0.0.0 255.255.255.255.

The wildcard is not a subnet mask applied to a different address: for 192.168.10.64 0.0.0.31 the router compares only the bits whose wildcard bit is 0. If you need the subnet maths first, see subnetting step by step.

Order and the implicit deny: a worked list

Requirement: the sales subnet 192.168.10.0/24 must not reach the web server 10.0.0.80 on port 80, but may reach everything else; the host 192.168.10.5 is the exception and may reach it.

ip access-list extended SALES-IN
 10 permit tcp host 192.168.10.5 host 10.0.0.80 eq 80
 20 deny   tcp 192.168.10.0 0.0.0.255 host 10.0.0.80 eq 80
 30 permit ip any any
!
interface g0/1
 ip access-group SALES-IN in

Packet from .5 to port 80: matches line 10, permitted, processing stops. Packet from .7 to port 80: line 10 does not match (different source), line 20 matches, dropped. Packet from .7 to anything else: lines 10 and 20 do not match, line 30 permits it. Swap lines 10 and 20 and .5 is blocked too, because the broader deny matches first. Delete line 30 and every packet that matched nothing is dropped by the implicit deny, which Cisco’s documentation describes as present at the end of every ACL. The consequence worth remembering: a list with only deny statements blocks everything.

Two more points the exam likes. Cisco’s guide notes that an inbound list filters before the routing lookup and an outbound list after it, and that filtering by source is done on the inbound interface. And an outbound interface ACL does not filter traffic that the router itself originates; for management access you apply a standard or extended ACL to the VTY lines with access-class. See network services and security explained for that.

Placement, and the reason behind the rule

Because a standard ACL sees only the source, putting it near the source would also block that source from everything else, so it goes close to the destination. An extended ACL can be specific, so putting it close to the source drops unwanted traffic before it crosses the network. These are the standard teaching rules; a question that gives you an exact requirement (“block only telnet to the server”) overrides them.

Which exams test this

How ACL questions are built

Three patterns. First, the ordering trap: a specific line placed after a broader one never matches. Second, the missing permit ip any any, where a correct deny silently blocks everything. Third, direction and interface: the right list on the wrong interface or with out instead of in. Constraint words that decide it: “only the source” (standard), “port 443” or “telnet” (extended), “closest to the destination” (standard placement), “all other traffic” (final permit), “inbound” (traffic entering the interface). Related: NAT types use an ACL to pick which addresses to translate, and the NSG rule evaluation guide shows the cloud counterpart, where rules are evaluated by priority rather than by list position.

Practice questions

Go deeper

• Cisco: Configuring commonly used IP ACLs
• Cisco: Creating an IP access list and applying it to an interface
• Related on this site: subnetting step by step, NAT types, NSG rule evaluation and the CCNA sample questions.