How ACLs Work
An ACL is a sequential list of permit or deny rules. When traffic arrives, the device checks each rule top-to-bottom until a match is found — it either permits or denies the traffic based on the matching rule and stops processing. The implicit deny all at the end: if no rule matches, traffic is denied. This is critical — any traffic not explicitly permitted by a rule is blocked by default.
ACL criteria: source IP address, destination IP address, protocol (TCP, UDP, ICMP), source port, destination port, and direction of traffic (inbound or outbound on an interface). Standard ACLs filter only by source IP. Extended ACLs filter by source/destination IP, protocol, and port — far more granular.
ACL placement: standard ACLs (source IP only) should be placed close to the destination — to avoid blocking traffic from the source to other destinations. Extended ACLs (source + destination + protocol) should be placed close to the source — to block traffic early and avoid wasting bandwidth.
ACL Applications
Perimeter security: ACLs on router interfaces facing the internet block known malicious traffic and restrict inbound connections to only allowed ports (anti-spoofing, deny RFC 1918 inbound from internet). Inter-VLAN access control: ACLs on Layer 3 switch SVIs or router subinterfaces control which VLANs can communicate with each other.
Best practices: most specific rules first (specific hosts before networks before any). Document each rule. Avoid 'permit any any' which allows all traffic. Keep ACLs as short as possible — long ACLs consume processor cycles for each packet. Test ACLs before applying to production — a mistake can block critical traffic.