Access control list (ACL)

An access control list (ACL) is an ordered sequence of permit and deny statements used to filter network traffic on routers and switches. When a packet arrives, the device compares it against the ACL's entries from the top down; the first matching rule wins and the rest are ignored. Every ACL ends with an implicit deny any — traffic that matches no entry is silently dropped — so an ACL with only deny statements blocks everything.

Cisco IOS distinguishes two main types. Standard ACLs filter only on source IP address and use numbers 1-99 (and 1300-1999). Extended ACLs match on source and destination address, protocol (IP, TCP, UDP, ICMP), and port numbers, using numbers 100-199 (and 2000-2699) — allowing rules as specific as "permit TCP from 10.1.1.0/24 to host 192.168.5.10 on port 443." Both types can also be created as named ACLs, which are easier to read and edit. Placement follows a classic rule of thumb: put extended ACLs close to the traffic's source, and standard ACLs close to the destination, since standard ACLs can't tell destinations apart.

An ACL does nothing until it is applied — typically to an interface in an inbound or outbound direction, with only one ACL per protocol, per interface, per direction. Beyond packet filtering, ACLs classify traffic for NAT, VPNs, quality of service, and route filtering.

ACLs are a core CCNA exam topic: expect questions on standard versus extended number ranges, top-down processing with the implicit deny, wildcard masks, placement guidelines, and reading a configuration to predict which packets are permitted.