ACL Verdict Calculator — TechKnowSurge

About this interactive

How a router processes an ACL, from the lesson: - It reads the access control entries **top down** and stops at the **first match**, taking that entry's permit or deny. Later entries are never read. - An unwritten **implicit deny any** ends the list, so a packet that matches no entry is dropped. - A new ACL does nothing until it is **applied** to an interface in a direction. - One ACL per interface, **per direction, per protocol**. - An ACL does not filter traffic the **router itself** starts. Standard ACLs match the source address alone; extended ACLs also match protocol, destination and port. Either can be numbered or named.

What you'll learn

Work a Cisco ACL from the top: the first matching entry decides, later entries are never read, and the unwritten deny any drops what matches nothing
Apply the rules around it: an ACL does nothing until applied, it does not filter the router's own traffic, and a router runs one ACL per interface, per direction, per protocol

Aligned to

Cisco CCNA

5.6 Configure and verify access control lists

Key terms

Access Control List: A set of rules that defines which users or systems are granted or denied access to a resource.
Implicit Deny: A foundational access control principle in which any traffic or request not explicitly permitted by a rule is automatically blocked. It appears as a hidden deny-all rule at the end of every access control list.
Access Control Entry: An individual rule within an access control list that specifies whether to permit or deny access for a particular user, group, or traffic pattern matching defined criteria. A complete ACL is made up of an ordered sequence of ACEs.
Standard ACL: An Access Control List that filters traffic based solely on the source IP address, using numbering ranges 1–99 and 1300–1999.
Extended ACL: An Access Control List that filters traffic based on source and destination IP addresses, protocol, and port numbers, using numbering ranges 100–199 and 2000–2699.
Wildcard Mask: A 32-bit mask used in ACL statements and OSPF network commands where a 0 bit means the corresponding address bit must match and a 1 bit means it can be anything. Wildcard masks are the inverse of subnet masks and allow a single statement to match an entire range of IP addresses.

Topics

Acl Access Control List Implicit Deny First Match Wildcard Mask Interactive Calculation

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →