¶ Overview
Cisco Standard ACL is an access control list used to filter network traffic based on Source IP Address.
¶ Configuration
¶ Creating a Standard ACL (Numbered)
Router(config)# access-list [ACL_NUMBER] [permit | deny] [SOURCE_IP] [WILDCARD_MASK]
- ACL_NUMBER: 1–99 or 1300–1999
- permit: Allows traffic from the specified IP address.
- deny: Blocks traffic from the specified IP address.
- SOURCE_IP: The source IP address to be filtered.
- WILDCARD_MASK: Defines the source IP address range.
Example:
Router(config)# access-list 10 permit 192.168.1.100 0.0.0.0
¶ Creating a Standard ACL (Named)
Router(config)# ip access-list standard [ACL_NAME]
Router(config-std-nacl)# permit [source] [wildcard-mask]
Router(config-std-nacl)# deny [source] [wildcard-mask]
Example:
Router(config)# ip access-list standard BLOCK_LAN1
Router(config-std-nacl)# deny 192.168.1.0 0.0.0.255
Router(config-std-nacl)# permit any
Router(config-std-nacl)# exit
¶ Apply ACL to an Interface
Router(config)# interface <interface_name>
Router(config-if)# access-list <acl_number>/<acl_name> in/out
- in: Applies the ACL to incoming packets.
- out: Applies the ACL to outgoing packets.
Example:
Router(config)# interface FastEthernet0/0
Router(config-if)# access-list 10 in
Router(config)# interface GigabitEthernet0/0
Router(config-if)# ip access-group BLOCK_LAN1 in
¶ Troubleshooting
Router# show access-lists
¶ Lab
¶ Topology
Objectives:
- LAN 1 is not allowed to access Server-B
- LAN 2 is not allowed to access Server-C
¶ Configuration
¶ Preconfiguration
hostname R1
!
ip dhcp excluded-address 192.168.1.1
ip dhcp excluded-address 192.168.2.1
!
ip dhcp pool LAN1
network 192.168.1.0 255.255.255.0
default-router 192.168.1.1
!
ip dhcp pool LAN2
network 192.168.2.0 255.255.255.0
default-router 192.168.2.1
interface FastEthernet0/0
ip address 192.168.1.1 255.255.255.0
no shutdown
!
interface FastEthernet0/1
ip address 192.168.2.1 255.255.255.0
no shutdown
!
interface FastEthernet1/0
ip address 172.16.1.1 255.255.255.252
no shutdown
!
router ospf 1
network 172.16.1.0 0.0.0.3 area 0
network 192.168.1.0 0.0.0.255 area 0
network 192.168.2.0 0.0.0.255 area 0
hostname R2
!
interface FastEthernet0/0
ip address 10.0.1.1 255.255.255.0
no shutdown
!
interface FastEthernet0/1
ip address 10.0.2.1 255.255.255.0
no shutdown
!
interface FastEthernet1/0
ip address 172.16.1.2 255.255.255.252
no shutdown
!
router ospf 1
network 10.0.1.0 0.0.0.255 area 0
network 10.0.2.0 0.0.0.255 area 0
network 172.16.1.0 0.0.0.3 area 0
¶ Standard ACL Configuration
Standard ACL is generally placed closest to the destination.
¶ Blocking LAN1 from accessing Server B
- The router closest to the destination is R2, so the ACL is configured on R2:
R2(config)#access-list 10 deny 192.168.1.0 0.0.0.255
R2(config)#access-list 10 permit any
- Apply it on the interface to Server B (Fa0/1)
R2(config)#interface fa0/1
R2(config-if)#ip access-group 10 out
R2(config-if)#exit
¶ Blocking LAN2 from accessing Server A
R2(config)#access-list 20 deny 192.168.2.0 0.0.0.255
R2(config)#access-list 20 permit any
- Apply it on the interface to Server A (Fa0/0)
R2(config)#interface fa0/0
R2(config-if)#ip access-group 20 out
R2(config-if)#exit
¶ Verification
PC-A1> show ip
NAME : PC-A1[1]
IP/MASK : 192.168.1.2/24
GATEWAY : 192.168.1.1
DNS :
MAC : 00:50:79:66:68:2c
LPORT : 20000
RHOST:PORT : 127.0.0.1:30000
MTU : 1500
PC-A1> ping 10.0.1.2
84 bytes from 10.0.1.2 icmp_seq=1 ttl=62 time=95.125 ms
84 bytes from 10.0.1.2 icmp_seq=2 ttl=62 time=65.038 ms
84 bytes from 10.0.1.2 icmp_seq=3 ttl=62 time=60.712 ms
84 bytes from 10.0.1.2 icmp_seq=4 ttl=62 time=63.358 ms
84 bytes from 10.0.1.2 icmp_seq=5 ttl=62 time=50.142 ms
PC-A1> ping 10.0.2.2
*172.16.1.2 icmp_seq=1 ttl=254 time=45.899 ms (ICMP type:3, code:13, Communication administratively prohibited)
*172.16.1.2 icmp_seq=2 ttl=254 time=32.774 ms (ICMP type:3, code:13, Communication administratively prohibited)
*172.16.1.2 icmp_seq=3 ttl=254 time=45.168 ms (ICMP type:3, code:13, Communication administratively prohibited)
*172.16.1.2 icmp_seq=4 ttl=254 time=34.268 ms (ICMP type:3, code:13, Communication administratively prohibited)
*172.16.1.2 icmp_seq=5 ttl=254 time=42.260 ms (ICMP type:3, code:13, Communication administratively prohibited)
PC-B1> show ip
NAME : PC-B1[1]
IP/MASK : 192.168.2.2/24
GATEWAY : 192.168.2.1
DNS :
DHCP SERVER : 192.168.2.1
DHCP LEASE : 67259, 86400/43200/75600
MAC : 00:50:79:66:68:2d
LPORT : 20000
RHOST:PORT : 127.0.0.1:30000
MTU : 1500
PC-B1> ping 10.0.1.2
*172.16.1.2 icmp_seq=1 ttl=254 time=46.086 ms (ICMP type:3, code:13, Communication administratively prohibited)
*172.16.1.2 icmp_seq=2 ttl=254 time=47.608 ms (ICMP type:3, code:13, Communication administratively prohibited)
*172.16.1.2 icmp_seq=3 ttl=254 time=47.629 ms (ICMP type:3, code:13, Communication administratively prohibited)
*172.16.1.2 icmp_seq=4 ttl=254 time=46.073 ms (ICMP type:3, code:13, Communication administratively prohibited)
*172.16.1.2 icmp_seq=5 ttl=254 time=46.126 ms (ICMP type:3, code:13, Communication administratively prohibited)
PC-B1> ping 10.0.2.2
84 bytes from 10.0.2.2 icmp_seq=1 ttl=62 time=83.063 ms
84 bytes from 10.0.2.2 icmp_seq=2 ttl=62 time=67.256 ms
84 bytes from 10.0.2.2 icmp_seq=3 ttl=62 time=61.611 ms
84 bytes from 10.0.2.2 icmp_seq=4 ttl=62 time=61.236 ms
84 bytes from 10.0.2.2 icmp_seq=5 ttl=62 time=62.238 ms