Standard ACLs
Source-only matching, wildcard masks, rule order and the implicit deny, with correct placement and verification.
An ACL is an ordered list of permit/deny rules evaluated top-down — first match wins. Every ACL ends with an invisible implicit deny any: unmatched traffic is dropped. Standard ACLs match only on the source IP — they cannot see destination or protocol.
Wildcard masks
| Wildcard | Matches | Equivalent |
|---|---|---|
| 0.0.0.0 | Exactly one host | Keyword host |
| 0.0.0.255 | A whole /24 | 192.168.10.0 0.0.0.255 |
| 0.0.0.63 | A /26 block | |
| 0.0.0.15 | A /28 block | |
| 255.255.255.255 | Everything | Keyword any |
0 bits must match; 1 bits are don't-care — the inverse of a subnet mask.
Allow only the admin subnet to vty lines — Privileged EXEC → Global + line configuration
Cisco IOS / IOS XE
configure terminal access-list 10 permit 192.168.99.0 0.0.0.255 line vty 0 15 access-class 10 in end
show access-lists show ip access-lists
- Match counters increment per evaluated packet/session.
- An empty counter on the expected rule means traffic isn't hitting it.
- Numbered standard ACLs: 1–99, 1300–1999. Named ACLs:
ip access-list standard NAME. - On interfaces, standard ACLs go close to the DESTINATION (they can't see it, so they block broadly).
Changes device configuration.
Placement rule: standard ACLs go near the destination because they only know the source — applied at the source side they would block that source from *everything*. Extended ACLs go near the source because they can surgically match destination+protocol, killing bad traffic early.
- ACL
- 10 permit 192.168.1.0 0.0.0.255 20 deny host 192.168.1.50
- Packets
- A: 192.168.1.50, B: 192.168.1.60, C: 10.0.0.5
- A hits rule 10 first (192.168.1.0/24 covers .50) → PERMITTED — the deny at line 20 never evaluates.
- B matches rule 10 → permitted.
- C matches nothing → implicit deny → dropped.
Order is law: put specific denies before broader permits or they're dead rules.
Sources
- Cisco CCNA 200-301 v1.1 Exam Topics (official PDF) — reviewed 2026-11-02
- Cisco — IP Addressing Services Command Reference — reviewed 2026-11-02
Targets CCNA 200-301 v1.1 objectives. Supplemental blocks are labeled beyond exam scope.