Access control lists are the oldest packet filters in networking and still among the most consequential lines in any configuration — one mis-ordered entry can cut off a data centre, and one absent entry can expose it. Their evaluation model takes five minutes to learn and a career to respect: statements are checked in order, the first statement that matches decides the packet's fate, evaluation stops, and any packet matching nothing is dropped by the implicit deny any that silently ends every list.
First-match logic and its consequences
- Order is policy: place specific entries above general ones. A permit ip any any at line 10 makes the forty lines beneath it decoration.
- The implicit deny means an ACL with only deny statements blocks everything — the final explicit permit is not optional if anything should pass.
- Counters tell the truth: show access-lists prints per-entry match counts; an entry with zero matches over a month is either dead policy or a misordered one that never gets reached.
- Sequence numbers (and named ACLs) allow surgical edits — ip access-list extended EDGE-IN then 15 deny ... inserts between 10 and 20; numbered-ACL folklore about 'delete and retype the whole list' died with sequence numbers.
Wildcard masks
ACLs match ranges with wildcard masks — bitwise inverses of subnet masks in the common cases: 0 bits mean 'must match', 1 bits mean 'don't care'. So 192.168.10.0 0.0.0.255 matches the /24, 10.0.0.0 0.255.255.255 matches the /8, host 10.1.1.1 abbreviates 10.1.1.1 0.0.0.0, and any abbreviates 0.0.0.0 255.255.255.255. Because the bits need not be contiguous, exotic matches (every odd subnet, one host in every /24) are possible — and occasionally even wise.
Standard vs extended, and placement
A standard ACL (1–99, or named) matches source address only — a blunt instrument that must sit close to the destination, because applied near the source it cuts the host off from everything, not just the protected resource. An extended ACL (100–199, or named) matches protocol, source and destination addresses, and ports — precise enough to sit close to the source, killing unwanted traffic before it crosses the network. That pair of placement rules — standard near destination, extended near source — is both an exam answer and sound engineering.
ip access-list extended EDGE-IN permit tcp 10.10.0.0 0.0.255.255 host 10.99.1.5 eq 443 permit udp any any eq 53 deny ip 10.10.0.0 0.0.255.255 10.99.0.0 0.0.255.255 log permit ip 10.10.0.0 0.0.255.255 anyinterface gi0/1 ip access-group EDGE-IN in
Beyond filtering
Half of an ACL's working life has nothing to do with dropping packets: ACLs select traffic for NAT (next chapter), match clauses in route maps, interesting traffic for VPNs, SNMP and VTY access classes, and QoS classification. In every role the same first-match, implicit-deny logic applies — which is why fluency here pays interest across the entire configuration. Two closing habits: add established/reflexive thinking (or better, a stateful firewall) for return traffic rather than mirror-image permits, and put log on your final explicit deny during rollout — the hits you see are the policy you forgot.