An access control list (ACL) is an ordered set of rules that permits or denies traffic. Network devices such as routers, switches and firewalls use ACLs to filter packets, protect management access and select traffic for features like NAT and QoS. There are several types of ACLs, and choosing the right one makes rules simpler and safer.
This guide compares the main types on Cisco devices, with syntax and examples.
Quick comparison
| Type | Matches on | Number range (Cisco) | Best placement |
|---|---|---|---|
| Standard | Source IP address only | 1–99 and 1300–1999 | Close to the destination |
| Extended | Source, destination, protocol and ports | 100–199 and 2000–2699 | Close to the source |
| Named | Same as standard or extended, with a name | Any descriptive name | As for its type |
| Time-based | Extended rules active at set times | Uses a time range | As for extended |
| Reflexive | Return traffic for sessions started inside | Named extended | Network edge |
| IPv6 | IPv6 addresses, protocols and ports | Named only | As for extended |
1. Standard ACLs
Standard ACLs check only the source IP address. They are simple, but they cannot tell one service from another.
access-list 10 deny host 192.168.1.50
access-list 10 permit 192.168.1.0 0.0.0.255Because they ignore the destination, place them close to the destination. Otherwise, you may block the source from far more than you intended. Standard ACLs are also handy for limiting SSH access to a router with access-class.
2. Extended ACLs
Extended ACLs match on source and destination addresses, the protocol (such as TCP, UDP or ICMP) and, optionally, port numbers. As a result, they can permit web traffic while blocking file sharing between the same hosts.
access-list 110 permit tcp 192.168.1.0 0.0.0.255 host 10.1.1.10 eq 443
access-list 110 deny ip 192.168.1.0 0.0.0.255 host 10.1.1.10
access-list 110 permit ip any anyThe parts of each line are:
- action:
permitordeny; - protocol:
ip,tcp,udp,icmpand others; - source and wildcard mask: for example
192.168.1.0 0.0.0.255; - destination and wildcard mask: or
hostfor a single address; - port operator:
eq,gt,lt,neqorrange, plus the port.
Place extended ACLs close to the source, so unwanted traffic stops early.
3. Named ACLs
Named ACLs work like standard or extended ACLs but use a descriptive name. They also let you insert or delete individual lines by sequence number, which numbered ACLs handle less gracefully.
ip access-list extended WEB-ONLY
10 permit tcp 192.168.1.0 0.0.0.255 any eq 443
20 deny ip any any logIn practice, most engineers prefer named ACLs for anything beyond a few lines.
4. Time-based ACLs
Time-based ACLs apply rules only during set periods, for example blocking social media during working hours.
time-range WORK-HOURS
periodic weekdays 9:00 to 18:00
ip access-list extended NO-SOCIAL
deny tcp 192.168.1.0 0.0.0.255 any eq 443 time-range WORK-HOURS5. Reflexive and established ACLs
Reflexive ACLs allow return traffic only for sessions started from inside the network. A simpler option is the established keyword, which allows TCP packets that belong to existing connections. Today, however, stateful firewalls usually handle this job better.
6. IPv6 ACLs
IPv6 ACLs are always named and work like extended ACLs. They end with implicit rules that permit neighbour discovery before the final implicit deny.
ACLs beyond networking
The term ACL also appears in operating systems, where file system ACLs grant permissions to specific users and groups. See our guide to advanced Linux permissions.
Related guides
Sources
Need help with network security? We test routers, firewalls, ACLs and segmentation as part of our VAPT services and hardening audits. Contact us for a quote.
