What is an Access Control List (ACL) and How to Configure Them!

In modern networking, Access Control Lists (ACLs) are foundational to securing network traffic. Whether you manage enterprise networks, branch offices, or cloud-connected devices, ACLs provide an efficient way to filter traffic at high speeds without the overhead of full firewalls.

ACLs are implemented primarily on routers and switches, but they can also be used on servers, hosts, and specialized network appliances. They define rules that allow or deny traffic based on IP addresses, protocols, or ports, ensuring that only authorized communication flows through your network.

While ACLs are not a replacement for advanced firewalls or intrusion prevention systems, they are essential for line-rate traffic filtering and minimizing exposure to unnecessary traffic, especially on high-throughput interfaces.

Understanding the Components of an ACL

An ACL is essentially a list of rules that control the flow of network traffic. Each entry defines a match condition and an action (permit or deny).

Here are the key components you’ll encounter when configuring ACLs:

• Sequence Number – Assign a unique number to identify each ACL entry.
• ACL Name – Some devices allow alphanumeric names instead of numbers for easier identification.
• Remark – Add comments to clarify the purpose of an ACL or specific entry.
• Statement – Defines whether the traffic should be permitted or denied.
• Network Protocol – Specifies protocols such as IP, TCP, UDP, ICMP, IPX, or NetBIOS.
• Source and Destination – Target addresses for the traffic; can be a single IP, a range (CIDR), or all addresses.
• Logging – Optional logging of matched ACL entries for monitoring or troubleshooting.
• Advanced Criteria – Some ACLs allow filtering by Type of Service (ToS), IP precedence, or Differentiated Services Code Point (DSCP) values.

Pro Tip: Always include a remark in your ACLs. In real-world environments, this simplifies troubleshooting and prevents accidental misconfigurations.

Types of ACLs and When to Use Them

ACLs come in multiple forms, each suited for specific scenarios. Understanding the differences is key for network security.

1. Standard ACL

Standard ACLs filter traffic only by source IP address. They are simple but limited in granularity. Use them for basic access restrictions where only source-based filtering is sufficient.

Example (Cisco syntax):

access-list 10 permit 192.168.1.0 0.0.0.255
interface fa0/0
ip access-group 10 in

Best Practice: Place standard ACLs close to the destination network to avoid inadvertently blocking legitimate traffic from multiple sources.

2. Extended ACL

Extended ACLs are more versatile—they filter traffic based on source and destination IP addresses, protocol types, and port numbers. This allows for fine-grained access control, such as permitting HTTP traffic while blocking Telnet or FTP.

Example (Cisco syntax):

access-list 100 permit tcp 192.168.1.0 0.0.0.255 10.1.1.0 0.0.0.255 eq 80
interface fa0/1
ip access-group 100 in

Best Practice: Place extended ACLs near the source to reduce unnecessary traffic in the network.

3. Dynamic ACL (Lock-and-Key ACL)

Dynamic ACLs require users to authenticate via Telnet or other credentials before being granted access. They are time-bound and often used for temporary or controlled access.

Real-World Use: Dynamic ACLs are ideal for contractor or guest access, providing security without permanent permissions.

4. Reflexive ACL

Reflexive ACLs, also known as IP session ACLs, dynamically create temporary rules based on outbound sessions. Once the session ends, the ACL entry is automatically removed.

Real-World Use: This is valuable for stateful traffic filtering without deploying a full firewall, especially for TCP-heavy applications where responses need to be allowed but unsolicited inbound connections blocked.

5. Time-Based ACLs

Time-based ACLs allow rules to be active only during certain hours. For example, you can restrict SSH access to your network after business hours or limit guest Wi-Fi to daytime usage.

Placement of ACLs: Best Practices

Correct placement of ACLs is critical for effectiveness and performance:

• Extended ACLs: Place near the source of traffic to prevent unwanted traffic from traversing multiple network segments.
• Standard ACLs: Place near the destination network since they filter only by source IP.
• Edge Routers: Always implement ACLs on internet-facing interfaces to block malicious or irrelevant traffic before it reaches your internal network.
• High-Speed Interfaces: Use ACLs on line-rate interfaces where firewalls could become a bottleneck.

Pro Tip: Avoid applying ACLs on every interface indiscriminately. Excessive ACLs can impact performance and complicate troubleshooting.

Implementing ACLs: Step-by-Step

When configuring ACLs, consider traffic direction (inbound vs. outbound) from the perspective of the interface.

Basic Guidelines:

1. ACLs are processed top-to-bottom. The first match determines the action.
2. Implicit deny: Every ACL has an invisible “deny all” at the end. If no rule matches, the traffic is blocked.
3. Single ACL per direction: You can apply one ACL per interface per direction.
4. Sequence Matters: Place specific rules above general rules.
5. Logging: Enable logging for critical ACLs to monitor denied traffic for troubleshooting.

Example: Deny ICMP but Allow IP Traffic

access-list 110 deny icmp any any
access-list 110 permit ip any any
interface fa0/0
ip access-group 110 in

Example: Allow Traffic Between Specific IPs

access-list 120 permit tcp 192.168.1.10 0.0.0.0 10.1.1.20 0.0.0.0 eq 22
access-list 120 permit tcp 192.168.1.11 0.0.0.0 10.1.1.21 0.0.0.0 eq 443
interface fa0/1
ip access-group 120 in

Example: Permit Range of IP Addresses

access-list 130 permit ip 192.168.1.0 0.0.0.255 10.1.1.0 0.0.0.255
interface fa0/2
ip access-group 130 in

Real-World Tips from IT Experts

1. Document ACLs: Always add remarks and maintain a configuration document. It saves hours during audits or troubleshooting.
2. Test Before Applying: Use lab environments or simulate traffic patterns to ensure ACLs don’t disrupt critical services.
3. Monitor Logs: Identify suspicious traffic and refine ACLs based on real network usage.
4. Combine with Firewalls: ACLs work best as part of a layered security strategy, complementing firewalls and IPS/IDS.
5. Regular Review: ACLs should be reviewed periodically to remove outdated rules and reduce network complexity.

Conclusion

Access Control Lists (ACLs) are invaluable tools for network security, enabling IT professionals to filter traffic efficiently, protect network segments, and manage access policies. While ACLs are simpler than full firewalls, when implemented thoughtfully with proper placement, logging, and monitoring, they form a critical line of defense.

For IT professionals, mastering ACLs is not just about configuring routers—it’s about understanding network flows, security risks, and operational impact. Combine ACLs with firewalls, logging, and authentication for a robust network defense strategy that balances security and performance.

Daniel Lutton

From my early days on the helpdesk through roles as a service desk manager, systems administrator, and network engineer, I’ve spent more than 25 years in the IT world. As I transition into cyber security, my goal is to make tech a little less confusing by sharing what I’ve learned and helping others wherever I can.