Work Through the ACL — TechKnowSurge

About this interactive

From the lesson: - An ACL is read **top to bottom**. The first statement a packet matches decides permit or deny, and the rest are never read. - Every ACL with at least one statement ends with a hidden **implicit deny any**: a packet that matches nothing is dropped, so a list of deny lines alone blocks everything. On Cisco IOS an ACL with no statements at all permits everything (the video says it kills all traffic). - A **standard** ACL matches only the source address; an **extended** ACL can match source, destination, protocol and port. - An ACL goes on an **interface** and a **direction**: **ingress** (coming into the device) or **egress** (going out of it), seen from the device. One per interface per direction (for one protocol): three interfaces give six. - A **stateful** firewall remembers outgoing requests and lets their replies back in, while unrequested traffic from outside is dropped unless a rule allows it. The ACLs here write address ranges out in full instead of with wildcard masks, which the lesson leaves for later.

What you'll learn

Work an access control list from the top: find the first statement a packet matches, its verdict, and when the implicit deny at the end decides
Apply the rest of the lesson: one ACL per interface per direction, ingress against egress, standard (source address) against extended (source, destination and port), and a stateful firewall's return traffic

Aligned to

CompTIA Network+

4.3 Given a scenario, apply network security features, defense techniques, and solutions

Cisco CCST Cybersecurity

2.3 Describe network infrastructure and technologies

Cisco CCNA

5.6 Configure and verify access control lists

Key terms

Access Control List: A set of rules that defines which users or systems are granted or denied access to a resource.
Implicit Deny: A foundational access control principle in which any traffic or request not explicitly permitted by a rule is automatically blocked. It appears as a hidden deny-all rule at the end of every access control list.
Standard Access Control List: An ACL that permits or denies traffic based solely on the source IP address of a packet.
Extended Access Control List: An ACL that permits or denies traffic based on source and destination IP addresses, protocol, and port, allowing more granular filtering than a standard ACL.
Ingress Filtering: The practice of monitoring and restricting inbound network traffic based on security policies.
Egress Filtering: The practice of monitoring and restricting outbound network traffic based on security policies.
Stateful Firewall: A firewall that tracks the state of active network connections and makes filtering decisions based on context.

Topics

Acl Firewall Implicit Deny Ingress Egress Stateful Firewall Interactive Calculation

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →