PlantUML DiagramStandard ACL Placement
A structured lesson workspace with readable content, hands-on examples, and a clean path to completion.
! Create a standard ACL permitting a specific subnetR1(config)# access-list 10 permit 10.10.20.0 0.0.0.255R1(config)# access-list 10 deny any log! Apply it to an interface in the outbound directionR1(config)# interface gigabitEthernet0/1R1(config-if)# ip access-group 10 outR1(config-if)# exit! VerifyR1# show access-listsR1# show ip interface gigabitEthernet0/1 | include access list
Standard ACL 10 permits the 10.10.20.0/24 subnet and explicitly denies everything else with logging enabled. Applied outbound on Gi0/1, it filters traffic leaving that interface toward the destination network. Any packet whose source IP isn't in 10.10.20.0/24 gets dropped.
Standard ACLs filter on source only — they can't distinguish 'A wants to reach X' from 'A wants to reach Y.' If you place the ACL near the source, you block A from reaching everything, not just your intended target. Place it near the destination so the filter applies only to traffic heading to the specific target.
! Scenario: allow only the IT subnet (10.10.20.0/24) to reach the server network (10.10.99.0/24)! Step 1 — create ACL on the router closest to the server networkR-SRV(config)# access-list 15 permit 10.10.20.0 0.0.0.255R-SRV(config)# access-list 15 deny any log! Step 2 — apply to the interface facing the serversR-SRV(config)# interface gigabitEthernet0/0R-SRV(config-if)# ip access-group 15 outR-SRV(config-if)# exit! Step 3 — verifyR-SRV# show access-lists 15Standard IP access list 1510 permit 10.10.20.0, wildcard bits 0.0.0.255 (15 matches)20 deny any log (3 matches)
Note the match counts. `15 matches` on the permit line, `3 matches` on the deny. The counters tell you the ACL is working — traffic is hitting the rules. If the counters aren't incrementing, the ACL isn't matching traffic (wrong interface, wrong direction, or the traffic path bypasses it).
Editing standard ACLs is painful — you can't delete a single line from a numbered ACL on older IOS. You have to delete the whole ACL and recreate it, or use named ACLs (next lesson). Best practice on modern IOS-XE: use named ACLs even for standard ACLs, so you can delete individual entries.
Create a standard ACL that permits only 10.10.10.0/24 and denies everything else with logging. Apply it outbound on the interface facing your test subnet. Verify with `show access-lists` and test with a ping from an allowed and disallowed source.
Finish the lesson once you have worked through the material. This awards ★ 15 XP.