TechKnowSurge
Cisco CCNA 5.6
TechKnowSurge Catalog Videos Standard ACLs
VideoNetworkFree

Standard ACLs

Standard access control lists (ACLs) filter network traffic based on source IP addresses using numbered or named entries, with an implicit deny-all applied to any unmatched traffic. Proper placement close to the destination — rather than the source — is essential to avoid unintentionally blocking legitimate traffic flows.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

Standard access control lists are a core tool in Cisco network security, used to permit or deny traffic based solely on a packet's source IP address. They can be configured as numbered lists — using values in the range of 1–99 or 1300–1999 to identify them as standard — or as named lists, where a descriptive label can communicate the ACL's purpose at a glance. Each access control entry (ACE) within a list shares the same identifying number or name, and the router evaluates entries sequentially until a match is found. Wildcard masks accompany each source address to define the scope of matching: all zeros require an exact host match, all ones match any address, and mixed values allow matching against specific subnets or summarized address ranges. A critical operational characteristic of every ACL is the implicit deny-all at the end of the list. Any packet that fails to match an explicit permit or deny statement is silently dropped, which can cause unintended traffic outages if an ACL is applied to an interface before all required permit entries are in place. Placement strategy is equally important — because standard ACLs can only reference source IP addresses, placing them near the traffic source risks blocking that source from reaching multiple destinations simultaneously. The recommended practice is to apply standard ACLs as close to the destination as possible, ensuring only the intended traffic path is affected while leaving other valid routes undisturbed.

What you'll learn

What's covered

Standard Access Lists

Aligned to

Cisco CCNA
5.6 Configure and verify access control lists

Key terms

Access Control List
ACL
A set of rules that defines which users or systems are granted or denied access to a resource.
Packet Filtering
A firewall technique that inspects packets and allows or blocks them based on source, destination, and protocol.
IP Address
A numerical label assigned to each device connected to a network that uses the Internet Protocol.
Standard ACL
An Access Control List that filters traffic based solely on the source IP address, using numbering ranges 1–99 and 1300–1999.
Wildcard Mask
A 32-bit mask used in ACL statements and OSPF network commands where a 0 bit means the corresponding address bit must match and a 1 bit means it can be anything. Wildcard masks are the inverse of subnet masks and allow a single statement to match an entire range of IP addresses.
Implicit Deny
A foundational access control principle in which any traffic or request not explicitly permitted by a rule is automatically blocked. It appears as a hidden deny-all rule at the end of every access control list.

Transcript

The Standard Access List

The standard access list is really quite simplistic. First of all, this is a numbered access list, and I can see that it is a numbered list by the numbers here, so this access list is number 42. Each of the access control entries here are grouped up together because of the 42 — that's what tells it that it's part of this number 42 access list.

The number 42 also says that this is a standard list. If it's between 199 and 1300 and 1999, that's what defines the range for a standard access list.

So what is a standard access list? All of this information at the end here are source IP addresses. It takes a look at the packet and looks at the source IP address, and that's how it determines what it's matching against.

The first one here is a host, and you can type out host and then the IP address, or you could exclude host and put in the wildcard mask of 0.0.0 — either would work for that right there. What it's doing is denying this host right here, and then it permits everything else from that same network that that host is on. Then it denies that site right there, and then it permits everything from all the other sites.

Once again, what's going to happen is that packet's going to come in, take a look at that source IP address, and try to match against each one of these and do that permit or deny. Then there's that implicit, unwritten deny all at the end of these access control lists that stops all other traffic if it doesn't match against anything. You've got to be careful of that, because if you apply an access list to an interface that doesn't have all your permit statements in it yet, then you're going to be blocking all of that traffic, so just be cautious of that.

There is also a named access list. You can name an access list, and this can be really handy, because that name can actually tell you what the function of the access list is trying to accomplish. You can incorporate that into the name, so that's nice.

Placement

Although we would like to create efficiency with this by putting this close to the source of the traffic, the problem is that could block too much traffic. An example of this: let's say I'm trying to block this demo laptop from reaching this network over here. If I were to put it over here on switch one, it would be very efficient, because it would block all the traffic from being processed along the way. The problem with that is it would block demo laptop from getting to any of these devices, because it's just blocking — this is just flat out blocking the source, which is this demo laptop. So what we'd want to do in this case is put it closer to the final destination. When it comes to standard access lists, put them closer to the final destination. That's the general rule when it comes to standard access lists.

Wildcard Masks

I'm not going to get really in depth into this, but wildcard masks essentially are often the reverse of whatever the subnet mask would be. A subnet mask has all ones that denote, or that flag, what the network bits are. Well, with wildcard masks the ones define the bits that we don't care about, that are wild cards, that could vary, that could be different.

If we have all zeros, that means that none of the bits can change — they all have to be exactly the same and match — and so that's going to match the host. If it was all ones, that means that it will match everything.

We can also create networks. If we create a network like in this case right here, this is a slash 24 network, and so we're just matching the network portion of this and the host bits we're not matching against. The ones are the wildcard part of that; those are the ones that we don't care as much about. I've got in here also a summary route with it that would extend beyond what a classful address would necessarily be, or whatever your subnets, how they're divided.

So these are wildcard masks, and you create a wildcard mask so that it could match the traffic that you're really trying to hone in on, that you're really trying to match against.

The standard access control list is the more simplistic of the two. We create the access control list and then we place it on the interface, and you're going to use wildcard masks to match the different networks and match the different source IP addresses that you're trying to match against.

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →