IPv4 ACLs

Why it exists

Routers forward by destination. Operators also need to refuse traffic that would otherwise be routed correctly — by source, by application port, or by both. Access lists are that filter on the forwarding path. RFC 1812 §5.3.9Packet Filtering and Access ListsRFC 1812 · PROPOSED STANDARD · June 1995

Vendor ACLs are the common teaching surface for that idea: ordered entries, first match, implicit deny at the end, and no effect until the list is applied to an interface or control plane feature. Cisco IOS XE 17.x — Creating an IP Access List §Information About Creating an IP Access List

Standard ACL: source address only

A standard list matches only the IPv4 source address. Applied inbound on the edge, it decides whether packets from a subnet are accepted before any other processing.

How it works

A standard list matches the IPv4 source address. An extended list can also match destination, protocol, and transport ports from the IP and TCP/UDP headers. RFC 791 §3.1Internet Header FormatRFC 791 · INTERNET STANDARD · September 1981

Entries are evaluated top-down. The first match decides permit or deny. If no entry matches, an implicit deny drops the packet. Cisco IOS XE 17.x — Creating an IP Access List §How to Create an IP Access List

Cisco-style wildcard masks invert subnet masks: 0 bits must match, 1 bits are don’t-care. 0.0.0.255 matches a /24; 0.0.0.0 is a host.

On the wire

Constructed examples, encoded from the field table below them — not captured traffic.

Configure it

When it breaks

Symptom first, because that is what you have when it happens.

1. A host that has an explicit permit is still dropped, and hit counters climb on an earlier deny.

   Narrow it down

   1. Read the list top-down against a packet that fails.
   2. Find the first matching entry — not the entry you intended.
   3. Check whether a broader deny sits above a more specific permit.

   Cause

   First-match evaluation. The deny matched first; later permits never ran.

   Fix

   Move the specific permit above the broad deny, or narrow the deny.

   Cisco IOS XE 17.x — Creating an IP Access List §How to Create an IP Access List

2. Only the traffic you permitted works; everything else dies even though you never wrote a deny.

   Narrow it down

   1. Confirm whether the list is applied on the path the failing traffic takes.
   2. Account for the implicit deny at the end of every IP ACL.
   3. Check hit counts on the last explicit line versus unexplained drops.

   Cause

   Fall-through to the implicit deny. Absence of an explicit deny is not an implicit permit.

   Fix

   Add the missing permits for traffic that must pass, in the correct order, before relying on the list in production.

3. The ACL looks correct and is applied, but the traffic it should catch is unaffected.

   Narrow it down

   1. Confirm in versus out on the interface relative to the device.
   2. Trace whether the packet enters or leaves that interface when filtered.
   3. Check whether a different interface is actually on the path.

   Cause

   Direction mismatch. Inbound filters packets entering the interface; outbound filters packets leaving it.

   Fix

   Re-apply on the correct direction, or move the list to the interface where the match keys are still visible.

4. A line meant to match a /24 matches almost everything, or matches nothing.

   Narrow it down

   1. Compare the wildcard to the intended mask: 0 bits must match, 1 bits are free.
   2. Check for a dotted mask used where a wildcard was required.
   3. Test with a single host address (wildcard 0.0.0.0) as a baseline.

   Cause

   Subnet mask and wildcard mask inverted. 255.255.255.0 as a wildcard matches almost any host octet pattern incorrectly relative to intent.

   Fix

   Rewrite using don’t-care bits: 0.0.0.255 for a /24, 0.0.0.0 for a host.

5. You need to allow one TCP port and block others to the same host; a standard ACL cannot express it.

   Narrow it down

   1. Confirm the list type: standard versus extended.
   2. Check whether destination or port appears in any line — standard lists reject that syntax.
   3. Verify the feature expecting the list accepts extended ACLs.

   Cause

   Standard ACLs match source address only.

   Fix

   Use an extended ACL (or vendor equivalent) that can match destination and ports.

   Cisco IOS XE 17.x — Creating an IP Access List §Information About Creating an IP Access List

Design notes

Place specific permits before broad denies. The opposite order silently disables the specifics.

Apply inbound to drop unwanted traffic before it consumes internal resources; apply outbound when the decision depends on the exit interface. Direction is relative to the device, not to the traffic’s ultimate destination.

An unapplied ACL does nothing. Creating the list is configuration; applying it is policy. Cisco IOS XE 17.x — Creating an IP Access List §Applying an Access List to an Interface

Misconceptions

“You must end every ACL with deny ip any any.”

IP ACLs already end with an implicit deny. An explicit final deny is optional and useful mainly when you want a logged counter on that line.

“Every matching line in the list contributes to the decision.”

Only the first match counts. Later lines are unreachable for that packet. Cisco IOS XE 17.x — Creating an IP Access List §How to Create an IP Access List

“Creating the access list enforces it.”

The list is inert until applied to an interface, a control-plane filter, a NAT reference, or another feature that consumes it. Cisco IOS XE 17.x — Creating an IP Access List §Applying an Access List to an Interface

More walkthroughs

Terms

Wildcard mask

A Cisco ACL match mask where 0 bits must equal the address and 1 bits are don’t-care. It is the inverse of a subnet mask: 0.0.0.255 matches a /24; 0.0.0.0 matches one host.

Implicit deny

The invisible final deny at the end of an IP ACL. Traffic that matches no explicit entry is dropped — absence of a deny line is not a permit.

Extended ACL

An IPv4 access list that can match source, destination, protocol, and transport ports. Standard lists match source address only.

Check yourself

• What does a standard IPv4 ACL match?

  • Source and destination addresses
  • Source address only
  • TCP and UDP ports only
  • MAC addresses
• Which wildcard matches a single host?

  • 0.0.0.255
  • 255.255.255.255
  • 0.0.0.0
  • 255.255.255.0
• A deny for a /24 sits above a permit for one host inside it. What happens to that host?

  • Permitted by the later line
  • Denied by the first match
  • Load-shared between both lines
  • Evaluated against both and permitted if either matches
• A packet matches no line in an applied IP ACL. What happens?

  • It is permitted
  • It is denied by the implicit deny
  • It is punted to the CPU for a decision
  • It is queued until a line matches
• ip access-group FILTER in on GigabitEthernet0/0 filters packets that…

  • Leave the router toward the eventual destination
  • Enter the router on that interface
  • Are originated by the router itself
  • Match any interface on the box
• Which headers supply the match keys for permit tcp any host X eq 443?

  • Ethernet only
  • IPv4 and TCP
  • UDP only
  • ICMP only
• You create an ACL but never apply it. What is its effect on forwarding?

  • Global deny for unmatched traffic
  • None — the list is inert until applied
  • It applies to all interfaces by default
  • It only filters router-originated traffic
• Why put specific permits before broad denies?

  • Hit counters are more accurate that way
  • Otherwise the broad deny matches first and the specifics never run
  • Implicit deny only works in that order
  • Extended ACLs require it syntactically

Related

• Static routing

  Installs an operator-authored next hop for a prefix, and uses a worse preference only when a better route of the same length disappears.

• TCP

  Turns a lossy packet network into an ordered byte stream, and decides how fast to send it using an algorithm that appears nowhere in the header.

• NAT

  Rewrites the IPv4 addresses — and usually the transport ports — at a realm boundary so many private hosts share fewer public addresses.