Standard ACLs
Source-only matching, wildcard masks, rule order and the implicit deny, with correct placement and verification.
Matching and order
An ACL is an ordered list of permit/deny rules evaluated top-down — first match wins. Every ACL ends with an invisible implicit deny any: unmatched traffic is dropped. Standard ACLs match only on the source IP — they cannot see destination or protocol.
- ACL
- 10 permit 192.168.1.0 0.0.0.255 20 deny host 192.168.1.50
- Packets
- A: 192.168.1.50, B: 192.168.1.60, C: 10.0.0.5
- A hits rule 10 first (192.168.1.0/24 covers .50) → PERMITTED — the deny at line 20 never evaluates.
- B matches rule 10 → permitted.
- C matches nothing → implicit deny → dropped.
Order is law: put specific denies before broader permits or they're dead rules.
Wildcard masks
Wildcard masks
| Wildcard | Matches | Equivalent |
|---|---|---|
| 0.0.0.0 | Exactly one host | Keyword host |
| 0.0.0.255 | A whole /24 | 192.168.10.0 0.0.0.255 |
| 0.0.0.63 | A /26 block | |
| 0.0.0.15 | A /28 block | |
| 255.255.255.255 | Everything | Keyword any |
0 bits must match; 1 bits are don't-care — the inverse of a subnet mask.
Placement and application
Placement rule: standard ACLs go near the destination because they only know the source — applied at the source side they would block that source from *everything*. Extended ACLs go near the source because they can surgically match destination+protocol, killing bad traffic early.
Allow only the admin subnet to vty lines — Privileged EXEC → Global + line configuration
Cisco IOS / IOS XE
configure terminal access-list 10 permit 192.168.99.0 0.0.0.255 line vty 0 15 access-class 10 in end
show access-lists show ip access-lists
- Match counters increment per evaluated packet/session.
- An empty counter on the expected rule means traffic isn't hitting it.
- Numbered standard ACLs: 1–99, 1300–1999. Named ACLs:
ip access-list standard NAME. - On interfaces, standard ACLs go close to the DESTINATION (they can't see it, so they block broadly).
Changes device configuration.
Standard IP access list 10Numbered list. 10 permit 192.168.99.0, wildcard bits 0.0.0.255 (42 matches)Match counter proves packets hit it. 20 deny any (7 matches)Explicit deny shows drops that would otherwise hide in the implicit deny.Verification
Verifying ACLs
- Match counters are the truth: incrementing counters on the right rule proves evaluation.
- An explicit
deny any logat the end makes the implicit deny visible in counters and logs. - Check the application point — the same ACL does nothing (or too much) in the wrong direction/interface.
Common mistakes
- Forgetting the implicit deny — 'no match' means 'deny', silently.
- Ordering a broad permit before a specific deny — the deny becomes unreachable.
- Using subnet masks instead of wildcards — a classic error that flips the meaning.
- Applying a standard ACL near the source — it then blocks the source from everything beyond.
- Applying
ip access-groupto the wrong direction —infilters arriving packets,outfilters leaving ones.
Observation: A deny rule exists; the traffic continues anyway.
- A preceding permit matches first
- ACL applied on wrong interface/direction
- Wildcard mask broader than intended
| Check | Indicates |
|---|---|
show access-lists counters | Which line actually matches — often not the one you wrote. |
| Interface/direction of application | ACL evaluates only the traffic it sees. |
| Wildcard math on the rule | 0.0.0.255 covers more than a single host. |
Correction: Reorder, reapply in the right place, or tighten the wildcard.
Deny counter increments and the traffic stops.
Sources
- Cisco CCNA 200-301 v1.1 Exam Topics (official PDF) — reviewed 2026-11-02
- Cisco — IP Addressing Services Command Reference — reviewed 2026-11-02
Targets CCNA 200-301 v1.1 objectives. Supplemental blocks are labeled beyond exam scope.