Securing Networks with Access Control Lists (ACLs)
Access Control Lists (ACLs) act as stateless packet filters on routers, permitting or denying traffic based on IP addresses, protocols, and port numbers.
Standard vs. Extended ACLs
Standard ACLs filter traffic based solely on the source IP address. Extended ACLs filter based on source/destination IP, protocol, and source/destination port numbers.
ACL Processing Rules
ACLs are processed top-down. The first matching statement is applied. If no match is found, the implicit 'deny all' rule at the end drops the packet.
Best Practices for Placement
Place Standard ACLs as close to the destination as possible. Place Extended ACLs as close to the source as possible to filter traffic early and save bandwidth.
❓ Frequently Asked Questions
What is the implicit deny?
It is a hidden rule at the end of every ACL that denies any traffic not explicitly permitted.
Where should an extended ACL be placed?
As close to the source of the traffic as possible.
What can a standard ACL filter on?
Only the source IP address.