A structured lesson workspace with readable content, hands-on examples, and a clean path to completion.
A new PCI compliance requirement says the card processing server on VLAN 30 can only be reached from the point-of-sale terminals on VLAN 40 and the management VLAN 99. It must be blocked from everywhere else. The requirement is real and enforced by auditors. An ACL is how you implement it.
Access control lists are Cisco's mechanism for filtering traffic based on packet header fields. They're used for security policy, traffic engineering, NAT selection, route filtering, and QoS classification. Once you learn ACLs for filtering, you'll find them everywhere in network configs.
The implicit deny is the most-forgotten feature of ACLs. An ACL with only permit statements silently drops everything else. If you want to allow a specific flow and block everything else, that's fine — but if you're building an allow-list and forget a flow, users complain about 'random' breakage. Remember the deny any at the end.
| Type | Matches on | Number range | Placement |
|---|---|---|---|
| Standard | Source IP only | 1-99, 1300-1999 | Close to destination |
| Extended | Source IP, destination IP, protocol, ports, TCP flags | 100-199, 2000-2699 | Close to source |
Standard ACLs are blunt instruments — they can only see the source IP. If you permit traffic from 10.10.10.0/24, you permit it to anywhere. Extended ACLs see the full picture — source, destination, protocol, port. They're what you use for real security policy.
ACLs use wildcard masks instead of subnet masks. A wildcard bit set to 0 means 'must match'; a bit set to 1 means 'ignore.' So `0.0.0.255` matches any host in the last octet — the inverse of a /24 subnet mask `255.255.255.0`.
! Match a specific hostpermit host 10.10.10.5! Equivalent to: permit ip 10.10.10.5 0.0.0.0! Match an entire /24 subnetpermit 10.10.10.0 0.0.0.255! Match any addresspermit any! Equivalent to: permit 0.0.0.0 255.255.255.255! Wildcard logic: 0 = must match, 1 = ignore! /24 mask: 255.255.255.0! Wildcard: 0.0.0.255
ACLs filter traffic based on header fields. Standard ACLs see source IP only; extended ACLs see the full picture. The implicit deny is real — plan for it. Next lesson configures standard ACLs.
Finish the lesson once you have worked through the material. This awards ★ 15 XP.