Understanding Standard ACLs for CCNA
Standard ACLs filter network traffic based solely on the source IPv4 address and should ideally be placed as close to the destination as possible.
What are Standard ACLs?
Standard Access Control Lists (ACLs) are the simplest form of traffic filtering in Cisco IOS. They evaluate only the **source IP address** of a packet to determine whether to permit or deny traffic. Because they lack granularity (they cannot filter by destination IP or port numbers), they are generally used for broad access control tasks. Standard ACLs are numbered from 1 to 99 and 1300 to 1999.
Standard ACL Placement Rules
A critical rule in networking is that **Standard ACLs should be placed as close to the destination as possible**. If placed too close to the source, they might inadvertently block traffic intended for other, legitimate destinations since they only check the source address.
* **Example:** If you want to block Host A from reaching Server B, applying a Standard ACL on Host A's local router would block Host A from reaching the entire network, not just Server B.
Configuration Example
To configure a Standard ACL to deny a specific host and permit all others, you use the global configuration mode:
* `Router(config)# access-list 10 deny host 192.168.1.50` * `Router(config)# access-list 10 permit any`
After creating the ACL, you must apply it to an interface in the inbound or outbound direction using the `ip access-group 10 [in | out]` command.
❓ Frequently Asked Questions
What is the numbering range for Standard ACLs?
Standard ACLs use numbers 1-99 and the expanded range 1300-1999.
Where should a standard ACL be placed?
Standard ACLs should be placed as close to the destination network as possible to avoid accidentally dropping legitimate traffic.
What is the implicit deny?
Every ACL has a hidden, implicit 'deny all' statement at the very end. If a packet doesn't match any explicit statements, it will be dropped.