Standard vs Extended ACLs on Cisco Routers: Lab with Examples

Access Control Lists (ACLs) are the first security tool every Cisco engineer learns, and they also show up in NAT, route filtering and QoS l...

Access Control Lists (ACLs) are the first security tool every Cisco engineer learns, and they also show up in NAT, route filtering and QoS later on. In this Packet Tracer 8.x lab you will configure one standard ACL and one extended ACL, learn how wildcard masks really work, see why placement matters, and verify every rule with show access-lists and real traffic tests.

Prefer video? Watch more hands-on labs on the Technical Hakim YouTube channel.

Standard vs extended at a glance

Feature	Standard ACL	Extended ACL
Numbered ranges	1–99 and 1300–1999	100–199 and 2000–2699
Matches on	Source IP address only	Protocol, source IP, destination IP, source and destination ports
Named form	ip access-list standard NAME	ip access-list extended NAME
Recommended placement	As close to the destination as possible	As close to the source as possible
Typical use	Block or allow whole networks, restrict VTY access, NAT matching	Allow specific services (web, DNS, SSH) and block others

Rules that apply to every ACL

• Entries are checked top to bottom, and the first match wins. Nothing below it is checked.
• Every ACL ends with an invisible implicit deny any. If you do not permit something, it is dropped.
• You can apply one ACL per interface, per direction, per protocol (for example one IPv4 ACL inbound and one outbound on G0/0).
• An ACL does nothing until it is applied, with ip access-group on an interface or access-class on VTY lines.
• An outbound ACL does not filter traffic generated by the router itself.

Wildcard masks

ACLs use wildcard masks, not subnet masks. In a wildcard, a 0 bit means "must match" and a 1 bit means "ignore". The quick way to get the wildcard for a subnet is to subtract the subnet mask from 255.255.255.255.

What you want to match	Address	Wildcard	Short form
One host	192.168.10.10	0.0.0.0	host 192.168.10.10
A /24 network	192.168.10.0	0.0.0.255	none
A /26 network (.64 to .127)	192.168.10.64	0.0.0.63	none
A /30 link	10.0.0.0	0.0.0.3	none
172.16.0.0 to 172.16.15.255 (/20)	172.16.0.0	0.0.15.255	none
Everything	0.0.0.0	255.255.255.255	any

Example: for a /20 the mask is 255.255.240.0. Subtracting from 255.255.255.255 gives 0.0.15.255.

Lab topology

Devices: two Cisco 2911 routers, three 2960 switches, three PCs and one Server.

Figure: ACL lab topology, showing where each ACL is applied.

Device	Interface	IP address	Mask	Gateway / notes
R1	G0/0	192.168.10.1	255.255.255.0	Sales LAN
R1	G0/1	192.168.20.1	255.255.255.0	HR LAN
R1	G0/2	10.0.0.1	255.255.255.252	Link to R2
R2	G0/2	10.0.0.2	255.255.255.252	Link to R1
R2	G0/0	192.168.30.1	255.255.255.0	Server LAN
PC1	Fa0	192.168.10.10	255.255.255.0	192.168.10.1 (Sales)
PC2	Fa0	192.168.10.11	255.255.255.0	192.168.10.1 (Sales)
PC3	Fa0	192.168.20.10	255.255.255.0	192.168.20.1 (HR)
Server1	Fa0	192.168.30.100	255.255.255.0	192.168.30.1 (HTTP on)

Base configuration

Address all interfaces from the table and add static routes so everything can reach everything before you add any ACL:

R1(config)# ip route 192.168.30.0 255.255.255.0 10.0.0.2

R2(config)# ip route 192.168.10.0 255.255.255.0 10.0.0.1
R2(config)# ip route 192.168.20.0 255.255.255.0 10.0.0.1

Test first: PC1 and PC3 should both ping 192.168.30.100 and open http://192.168.30.100 in the PC Web Browser. Never build an ACL on a network that does not work yet, or you will not know which problem you are fixing.

Task 1: Standard ACL

Requirement: the HR LAN (192.168.20.0/24) must not reach the Server LAN. All other traffic is allowed.

A standard ACL only sees the source address. If you put it close to the source (R1 G0/1 inbound), HR would be blocked from everything behind R1, including the Sales LAN. So we place it close to the destination: R2 G0/0, outbound toward the servers.

R2(config)# access-list 10 remark Block HR from Server LAN
R2(config)# access-list 10 deny 192.168.20.0 0.0.0.255
R2(config)# access-list 10 permit any
R2(config)# interface gigabitEthernet 0/0
R2(config-if)# ip access-group 10 out
R2(config-if)# end

• access-list 10 remark adds a comment that appears in the running configuration. Use it; your future self will thank you.
• access-list 10 deny 192.168.20.0 0.0.0.255 matches any source from 192.168.20.0 to 192.168.20.255.
• access-list 10 permit any is required. Without it, the implicit deny would block the Sales LAN too.
• ip access-group 10 out applies the list to packets leaving G0/0 toward the servers.

The same ACL in named form looks like this:

R2(config)# ip access-list standard BLOCK-HR
R2(config-std-nacl)# deny 192.168.20.0 0.0.0.255
R2(config-std-nacl)# permit any

Named ACLs are easier to read and easier to edit, because you can insert or delete individual lines by sequence number.

Task 2: Extended ACL

Requirement: the Sales LAN may reach Server1 only with HTTP (TCP port 80). All other traffic from Sales to Server1, including ping, is blocked. Sales can still reach everything else.

An extended ACL can match destination and port, so we place it close to the source to drop unwanted traffic before it crosses the network: R1 G0/0, inbound from Sales.

R1(config)# ip access-list extended SALES-TO-SERVER
R1(config-ext-nacl)# remark Sales may only use HTTP to Server1
R1(config-ext-nacl)# permit tcp 192.168.10.0 0.0.0.255 host 192.168.30.100 eq 80
R1(config-ext-nacl)# deny ip 192.168.10.0 0.0.0.255 host 192.168.30.100
R1(config-ext-nacl)# permit ip any any
R1(config-ext-nacl)# exit
R1(config)# interface gigabitEthernet 0/0
R1(config-if)# ip access-group SALES-TO-SERVER in
R1(config-if)# end

• permit tcp ... host 192.168.30.100 eq 80 allows TCP from any Sales host to Server1 with destination port 80. The order of fields is always protocol, source, source port (optional), destination, destination port.
• deny ip ... host 192.168.30.100 blocks every other IP protocol from Sales to Server1, including ICMP. Because it comes after the HTTP permit, web traffic has already matched and is not affected.
• permit ip any any lets Sales reach everything else.

The equivalent numbered version would use 100–199, for example access-list 100 permit tcp 192.168.10.0 0.0.0.255 host 192.168.30.100 eq www.

Bonus: restrict SSH or Telnet to the router

Standard ACLs are also the normal way to control who can manage a router. To allow only PC3 to open VTY sessions on R1:

R1(config)# access-list 5 permit host 192.168.20.10
R1(config)# line vty 0 4
R1(config-line)# access-class 5 in

Note the different command: access-class on lines, ip access-group on interfaces.

Verification

Generate traffic first

From PC1 (Sales), open the Web Browser to http://192.168.30.100. The page loads. Now ping the server:

C:\>ping 192.168.30.100

Pinging 192.168.30.100 with 32 bytes of data:

Reply from 192.168.10.1: Destination host unreachable.
Reply from 192.168.10.1: Destination host unreachable.
Reply from 192.168.10.1: Destination host unreachable.
Reply from 192.168.10.1: Destination host unreachable.

Ping statistics for 192.168.30.100:
    Packets: Sent = 4, Received = 0, Lost = 4 (100% loss),

The reply comes from R1's G0/0 address (192.168.10.1), which tells you R1 dropped the packet and sent back an ICMP unreachable message. That is the ACL working. From PC3 (HR), both the ping and the web page to Server1 fail because of the standard ACL on R2, but PC3 can still ping PC1.

show access-lists

R1# show access-lists
Standard IP access list 5
    10 permit 192.168.20.10
Extended IP access list SALES-TO-SERVER
    10 permit tcp 192.168.10.0 0.0.0.255 host 192.168.30.100 eq www (12 match(es))
    20 deny ip 192.168.10.0 0.0.0.255 host 192.168.30.100 (4 match(es))
    30 permit ip any any (6 match(es))

R2# show access-lists
Standard IP access list 10
    10 deny 192.168.20.0 0.0.0.255 (8 match(es))
    20 permit any (16 match(es))

Each line has a sequence number (10, 20, 30) and a match counter. IOS shows port 80 as www, and shows a standard host entry without the host keyword, which is normal. ACL 5 has no counter yet because nobody has tried to open a VTY session. The counters are the fastest way to prove which line is catching your traffic. Your numbers will differ depending on how much you tested. To reset them, use clear access-list counters.

Check where the ACL is applied

R1# show ip interface gigabitEthernet 0/0
GigabitEthernet0/0 is up, line protocol is up (connected)
  Internet address is 192.168.10.1/24
  ...
  Outgoing access list is not set
  Inbound  access list is SALES-TO-SERVER
  ...

Always confirm the direction. An ACL applied out when you meant in is one of the most common reasons "the ACL does nothing". (Output trimmed.)

Editing a named ACL

To allow HTTPS as well, insert a line between 10 and 20 using a sequence number:

R1(config)# ip access-list extended SALES-TO-SERVER
R1(config-ext-nacl)# 15 permit tcp 192.168.10.0 0.0.0.255 host 192.168.30.100 eq 443

Common mistakes

• Forgetting the final permit. An ACL with only deny lines blocks everything because of the implicit deny.
• Wrong order. Putting deny ip ... host 192.168.30.100 above the HTTP permit blocks the web traffic too, since the first match wins.
• Subnet mask instead of wildcard. access-list 10 deny 192.168.20.0 255.255.255.0 does not match the HR network as intended. Use 0.0.0.255.
• Standard ACL near the source. It blocks the source from every destination, not just the one you meant.
• Wrong direction. Remember that in and out are from the router's point of view on that interface.
• Re-typing a numbered ACL to fix it. New lines are added at the end. Remove the ACL with no access-list 10 and rebuild it, or use a named ACL and edit by sequence number.

Summary

Standard ACLs match only the source address and belong near the destination. Extended ACLs match protocol, source, destination and ports, and belong near the source. Both are processed top-down with an implicit deny at the end, and both use wildcard masks (255.255.255.255 minus the subnet mask). Apply them with ip access-group (or access-class on VTY lines), then prove they work with test traffic, show access-lists counters and show ip interface.

Related tutorials

• Subnetting Made Simple: /24 to /30 with Worked Examples
• Basic Cisco Router Setup: Hostname, Passwords, Banner and SSH
• OSPF Single-Area Configuration: Full Lab with Verification
• Inter-VLAN Routing with Router-on-a-Stick (Packet Tracer Lab)

Sources

• Cisco Security Configuration Guide: Access Control Lists
• Cisco IOS Security Command Reference (access-list, ip access-list, ip access-group, access-class)
• RFC 9110, HTTP Semantics (port 80 and 443 usage): https://www.rfc-editor.org/rfc/rfc9110
• RFC 792, Internet Control Message Protocol: https://www.rfc-editor.org/rfc/rfc792