Cisco IOS ACL Configuration
Named extended and standard ACLs with interface application for Cisco IOS/IOS-XE. Includes object-group references and time-based ACE support.
What is it?
An ACL (Access Control List) is an ordered list of permit/deny rules that a Cisco IOS router or switch evaluates against IP traffic. Each rule (ACE — Access Control Entry) matches on source/destination IP, protocol, and ports. The router processes rules top to bottom, and the first match wins. If no rule matches, the implicit 'deny any' at the end drops the packet. ACLs are the primary tool for traffic filtering on IOS devices — from blocking unwanted traffic to protecting management access.
When to use
- ·Filtering traffic entering or leaving a router interface (inbound/outbound)
- ·Protecting the router's management plane — restrict SSH/Telnet to specific source IPs
- ·Defining 'interesting traffic' for VPN tunnels (crypto ACL)
- ·Rate-limiting or classifying traffic for QoS policies
- ·Blocking specific protocols or hosts between network segments
When NOT to use
- ·Complex stateful firewall rules — use a dedicated firewall (ASA, Palo Alto) instead. IOS ACLs are stateless.
- ·Application-layer filtering (HTTP content, URL filtering) — IOS ACLs work at L3/L4 only
- ·High-availability environments requiring connection state tracking — ACLs don't track TCP sessions
How it compares
Prerequisites
- →Understanding of wildcard masks: 0.0.0.255 matches any host in the /24 (inverse of subnet mask)
- →Know which direction to apply the ACL: 'in' filters traffic as it arrives on the interface, 'out' filters before it leaves
- →Plan the ACE order carefully — more specific rules must come before general ones
- →Always include a permit for return traffic when filtering bidirectional flows (unless using stateful inspection)
Config Generator
Verification commands
show ip access-listsShow all ACLs with hit counts per ACE
ExpectedEach ACE shows a match count. Zero matches may indicate the rule is never reached (blocked by an earlier rule).
show ip interface <interface>Verify which ACLs are applied to an interface and in which direction
ExpectedShows 'Inbound access list' and 'Outbound access list' fields
show access-lists <name>Show a specific ACL with its entries and hit counts
ExpectedEntries with 0 hits may indicate misconfigured ACE or traffic not reaching the interface
Debug commands
debug ip packet <acl-name> detailDebug packets matching a specific ACL — shows permit/deny decisions in real time
WarningGenerates heavy output. Only use in lab or maintenance window. 'undebug all' immediately after.
Common mistakes & fixes
Further learning
Recommended books to go deeper on this topic.
IPv6 Security
Scott Hogg, Eric Vyncke · Cisco Press · Filtering IPv6 with ACLs on IOS and ASA, ICMPv6 and Neighbour Discovery, first-hop security
Network Security Architectures
Sean Convery · Cisco Press · ACL design patterns, PACL, VACL, defense-in-depth strategies