Standard and Extended ACLs on Cisco Routers: A Simple Guide for Beginners

 A Cisco ACL (Access Control List) is a list of rules that tells a router which traffic to allow and which traffic to block. ACLs are one of the most important CCNA topics, and they are used in real networks every day to control who can reach what.

In this guide, you will learn how ACLs work, the difference between standard and extended ACLs, and how to configure and verify them with simple examples.

Cisco ACL in One Minute

• ACL: An ordered list of permit and deny rules.
• Standard ACL: Filters by source IP address only.
• Extended ACL: Filters by source, destination, protocol, and port.
• Applied to: An interface, in the inbound or outbound direction.
• Important: Every ACL ends with a hidden deny all rule.

What Is an ACL?

An ACL checks each packet against a list of rules. Each rule says permit (allow) or deny (block), and describes which packets it applies to.

Common uses for ACLs:

• Block a specific device or network from reaching another network.
• Allow only certain services, such as web traffic.
• Limit who can manage a device remotely.
• Select traffic for other features, such as NAT.

How an ACL Works

The router reads the rules from top to bottom. It stops at the first rule that matches the packet and does what that rule says. It does not check the rules below it.

If no rule matches, the packet is blocked by the implicit deny at the end of every ACL. You cannot see this rule, but it is always there.

This means two things:

• Order matters. Put specific rules first and general rules last.
• You usually need a permit rule. If you only write deny rules, all other traffic will also be blocked.

Standard vs. Extended ACL

Feature	Standard	Extended
Number range	1–99, 1300–1999	100–199, 2000–2699
Filters by	Source IP only	Source, destination, protocol, port
Best placed	Close to the destination	Close to the source
Control	Basic	Detailed

Why the different placement? A standard ACL cannot see the destination, so if you place it close to the source it may block traffic you wanted to allow. An extended ACL is precise, so you place it close to the source and stop unwanted traffic early.

Named ACLs

Instead of a number, you can give an ACL a name. Named ACLs are easier to read and easier to edit.

ip access-list standard BLOCK-PC
ip access-list extended WEB-ONLY

What Is a Wildcard Mask?

ACLs use a wildcard mask instead of a subnet mask. It works like an inverted mask:

• 0 means the bit must match.
• 1 means the bit can be ignored.

To calculate it, subtract each octet of the subnet mask from 255.

Subnet mask	Wildcard mask
255.255.255.0	0.0.0.255
255.255.255.192	0.0.0.63
255.255.0.0	0.0.255.255

Two shortcuts:

• host 192.168.10.50 means exactly one device (the same as 192.168.10.50 0.0.0.0).
• any means every address (the same as 0.0.0.0 255.255.255.255).

If subnet masks are new to you, read our guide on Subnetting Step by Step: A Simple Guide for Beginners.

Example Network

We will use this simple network on router R1:

Network	Address	Interface
LAN 1	192.168.10.0/24	G0/0
LAN 2	192.168.20.0/24	G0/1

The web server is 192.168.20.10 in LAN 2.

Standard ACL Example

Goal: Block the PC 192.168.10.50 from reaching LAN 2, but allow everyone else.

A standard ACL is placed close to the destination, so we apply it to G0/1 in the outbound direction.

R1(config)# access-list 10 deny host 192.168.10.50
R1(config)# access-list 10 permit any
R1(config)# interface g0/1
R1(config-if)# ip access-group 10 out

How it works:

1. The first rule blocks the one PC.
2. The second rule allows everyone else. Without it, the implicit deny would block all traffic.
3. The ACL is applied to G0/1 for traffic leaving toward LAN 2.

Extended ACL Example

Goal: Allow LAN 1 to reach the web server using only HTTP and HTTPS, and block all other traffic to that server.

An extended ACL is placed close to the source, so we apply it to G0/0 in the inbound direction.

R1(config)# ip access-list extended WEB-ONLY
R1(config-ext-nacl)# permit tcp 192.168.10.0 0.0.0.255 host 192.168.20.10 eq 80
R1(config-ext-nacl)# permit tcp 192.168.10.0 0.0.0.255 host 192.168.20.10 eq 443
R1(config-ext-nacl)# deny ip any host 192.168.20.10
R1(config-ext-nacl)# permit ip any any
R1(config-ext-nacl)# exit
R1(config)# interface g0/0
R1(config-if)# ip access-group WEB-ONLY in

How it works:

1. Web traffic (TCP ports 80 and 443) to the server is allowed.
2. Any other traffic to the server is blocked.
3. All other traffic to other destinations is allowed.

To learn more about port numbers, read our guide on Common Network Ports and Protocols. And to understand why web traffic uses TCP, read TCP vs UDP: Key Differences Explained for Beginners.

Inbound vs. Outbound

Direction	Meaning
In	Checks packets entering the interface
Out	Checks packets leaving the interface

You can apply only one ACL per interface, per direction, per protocol.

How to Verify an ACL

Use these commands:

show access-lists
show ip interface g0/0
show running-config | section access-list

• show access-lists shows all rules and how many packets matched each rule. This is the best way to test your ACL.
• show ip interface g0/0 shows which ACL is applied to the interface and in which direction.

How to Edit or Remove an ACL

• Remove an ACL from an interface: Use no ip access-group under the interface.
• Delete a numbered ACL completely: no access-list 10.
• Edit a named ACL: Enter the ACL and use sequence numbers, for example no 20 to remove line 20, or 15 permit ... to insert a rule between lines 10 and 20.

Be careful when you change an ACL on a live network, because a wrong rule can block users or even your own remote access.

Common ACL Mistakes

• Forgetting the implicit deny: All other traffic is blocked if you do not add a permit rule.
• Wrong order: A permit any placed before a deny rule makes the deny useless.
• Wrong wildcard mask: Remember it is the inverse of the subnet mask.
• Wrong direction or interface: The ACL exists but does not match the traffic.
• Creating the ACL but not applying it: An ACL does nothing until you apply it with ip access-group.

Frequently Asked Questions

What is an ACL in Cisco?

It is a list of permit and deny rules that a router uses to filter traffic.

What is the difference between standard and extended ACLs?

A standard ACL filters by source IP address only. An extended ACL can filter by source, destination, protocol, and port.

Why is my traffic blocked when I did not write a deny rule?

Every ACL has a hidden deny all rule at the end. Add a permit rule for the traffic you want to allow.

Where should I place standard and extended ACLs?

Place standard ACLs close to the destination and extended ACLs close to the source.

Is an ACL the same as a firewall?

No. A router ACL is a basic packet filter. A dedicated firewall, such as FortiGate, can inspect traffic in more detail and track connections.

Can I practice ACLs for free?

Yes. Cisco Packet Tracer is a free tool where you can build the example network from this guide and test each rule.

Conclusion

ACLs give you control over the traffic in your network. Remember the main rules: the router reads from top to bottom, it stops at the first match, and every ACL ends with an implicit deny. Use standard ACLs for simple source filtering and extended ACLs when you need more detail.

To practice, build the example network in Packet Tracer and try changing the rules.

Next on BayteNet: NAT and PAT Configuration on Cisco Routers.

Leave a comment if you have any questions!