Demystifying Cisco Access Control Lists
Cisco IOS firewalls and routers utilize Access Control Lists (ACLs) to filter traffic. Understanding their syntax is critical for network engineers.
Standard vs. Extended ACLs
- **Standard ACLs (Numbered 1-99 and 1300-1999):** These are rudimentary filters that can *only* evaluate the source IP address. They cannot filter by destination or protocol type.
- **Extended ACLs (Numbered 100-199 and 2000-2699):** Highly granular filters capable of evaluating source IP, destination IP, protocol (TCP/UDP/ICMP), and specific port numbers.
The Inverse Logic of Wildcard Masks
Cisco ACLs do not use standard subnet masks (e.g., `255.255.255.0`). Instead, they use Wildcard Masks, which operate on inverse boolean logic.
In a wildcard mask:
- A `0` bit tells the router: **Match this exactly.**
- A `1` bit tells the router: **Ignore this bit (I don't care).**
Calculating a Wildcard Mask
The fastest way to calculate a wildcard mask is to subtract the standard [subnet mask](/tools/subnet-calculator/subnet-mask-reference-table) from a theoretical `255.255.255.255` address.
**Mathematical Proof for a /26 Subnet:**
255.255.255.255 (Absolute Maximum)
- 255.255.255.192 (Standard /26 [Subnet Mask](/tools/subnet-calculator/subnet-mask-reference-table))
-----------------
0 . 0 . 0 . 63 (Resulting Wildcard Mask)
Syntax Examples in Production
To permit web traffic (port 80) from a specific `/26` subnet to any external destination, the syntax is:
access-list 101 permit tcp 192.168.1.0 0.0.0.63 any eq 80To block a single malicious host using the `host` keyword shortcut (equivalent to a `0.0.0.0` wildcard mask):
access-list 101 deny ip host 10.5.5.50 any