ACL Questions and Answers: Practical Cisco Examples

Reading about access control lists is one thing. Writing a correct ACL under exam or production pressure is another. These ACL questions take you through realistic Cisco scenarios, from blocking FTP to allowing only email between two sites, and explain every line of each answer.

If you need a refresher first, read our guides on standard ACLs and extended ACLs.

Quick rules before you start

Keep these rules in mind for every answer:

A router checks ACL lines from top to bottom and stops at the first match.
Every ACL ends with an invisible implicit deny any. Therefore, add a permit line if other traffic should pass.
Wildcard masks are the inverse of subnet masks. For example, /24 becomes 0.0.0.255.
Place extended ACLs close to the source, and standard ACLs close to the destination.
An ACL does nothing until you apply it to an interface with ip access-group (or to VTY lines with access-class).

Question 1: Block FTP, limit Telnet and stop web browsing

Write one extended ACL with these conditions:

No host on network 200.100.50.0/24 may use FTP anywhere.
Only hosts on 150.75.0.0/16 may Telnet to network 50.0.0.0/8.
Subnet 100.100.100.0/24 may not browse the web.
All other traffic is allowed.

Answer

ip access-list extended Q1-POLICY
 remark No FTP from 200.100.50.0/24
 deny   tcp 200.100.50.0 0.0.0.255 any eq ftp
 deny   tcp 200.100.50.0 0.0.0.255 any eq ftp-data
 remark Telnet to 50.0.0.0/8 only from 150.75.0.0/16
 permit tcp 150.75.0.0 0.0.255.255 50.0.0.0 0.255.255.255 eq telnet
 deny   tcp any 50.0.0.0 0.255.255.255 eq telnet
 remark No web browsing from 100.100.100.0/24
 deny   tcp 100.100.100.0 0.0.0.255 any eq www
 deny   tcp 100.100.100.0 0.0.0.255 any eq 443
 permit ip any any

Explanation

First, FTP uses TCP 21 for control and, in active mode, TCP 20 for data. Blocking port 21 is enough to stop new sessions, but blocking both is cleaner. Next, the Telnet rules must stay in this order. The permit for 150.75.0.0 has to come before the general deny, because the first match wins. In addition, today’s web runs mostly on HTTPS, so the answer blocks port 443 as well as port 80. Finally, permit ip any any overrides the implicit deny.

Apply the ACL inbound on the router interfaces that face these source networks.

Question 2: Permit email only between two networks

You manage network 200.100.50.0/24. Your mail server is 200.100.50.25. Users on 150.75.0.0/16 may only reach your network for email: SMTP (TCP 25) and POP3 (TCP 110, or 995 with TLS). All other traffic between the two networks is blocked. However, traffic to other destinations is not restricted.

Answer

Apply this ACL inbound on the router interface that faces 150.75.0.0/16:

ip access-list extended EMAIL-ONLY
 permit tcp 150.75.0.0 0.0.255.255 host 200.100.50.25 eq smtp
 permit tcp 150.75.0.0 0.0.255.255 host 200.100.50.25 eq pop3
 permit tcp 150.75.0.0 0.0.255.255 host 200.100.50.25 eq 995
 permit tcp 150.75.0.0 0.0.255.255 host 200.100.50.25 established
 deny   ip 150.75.0.0 0.0.255.255 200.100.50.0 0.0.0.255
 permit ip any any
!
interface GigabitEthernet0/1
 ip access-group EMAIL-ONLY in

Explanation

The first three lines let remote users and mail servers reach your mail server. The established line allows replies to connections that your mail server opened, for example when it delivers mail to their SMTP server. Then the deny line blocks everything else from 150.75.0.0 to your network. Finally, the last line lets the remote network reach other destinations freely.

Notice that the original exam-style answer, which simply denied SMTP and POP3 everywhere, would break email for every other network. That is a common mistake.

Question 3: Block one host but allow its subnet

Host 192.168.10.50 must not reach the server network 10.1.1.0/24. Every other host may. Use a standard ACL.

access-list 10 deny host 192.168.10.50
access-list 10 permit any
!
interface GigabitEthernet0/2
 ip access-group 10 out

A standard ACL only checks the source address. So apply it outbound on the interface closest to the server network, otherwise you block the host from everything.

Question 4: Allow SSH to the router only from the admin subnet

Only 10.10.99.0/24 may manage the router over SSH.

ip access-list standard MGMT
 permit 10.10.99.0 0.0.0.255
!
line vty 0 4
 access-class MGMT in
 transport input ssh

Here, access-class filters logins to the router itself, rather than traffic passing through it.

Question 5: What does this ACL do?

access-list 110 permit tcp any any eq 443
access-list 110 deny ip 10.0.0.0 0.255.255.255 any

Answer: it permits HTTPS from anyone. Then it denies all other traffic from 10.0.0.0/8. However, traffic from any other source is also dropped by the implicit deny. So the only traffic that passes is HTTPS.

How to verify your ACLs

show access-lists shows each line with its hit counter.
show ip interface GigabitEthernet0/1 shows which ACLs are applied and in which direction.
clear access-list counters resets counters before a test.

For deeper DHCP and routing context, see how to configure DHCP on a Cisco router.

Sources

Cisco: Configure commonly used IP ACLs

Need help with network security? We test routers, firewalls, ACLs and segmentation as part of our VAPT services and hardening audits. Contact us for a quote.