Access Control Lists and Traffic Filtering

Learning objectives

• Explain the purpose and scope of Access Control Lists and Traffic Filtering.
• Identify important protocols, roles, fields, and terminology.
• Apply the concept to a practical network scenario.
• Use IOS XE commands to verify operational behavior.

1. Core concepts

An ACL is an ordered set of permit and deny statements applied to traffic. IOS XE evaluates entries from top to bottom and stops at the first match. An implicit deny any exists at the end. Standard IPv4 ACLs primarily match source addresses. Extended ACLs can match source, destination, protocol, and TCP/UDP ports.

2. How it works

Wildcard masks identify which address bits an ACL must match. A 0 bit means match exactly; a 1 bit means ignore that bit. A /24 subnet mask 255.255.255.0 corresponds to wildcard 0.0.0.255. Standard ACLs are traditionally placed closer to the destination. Extended ACLs are often placed closer to the source when practical.

Visual walkthrough

3. Worked example

Permit HTTPS from 192.168.10.0/24 to server 192.0.2.20 with an extended ACL, then deny other IP traffic to that server and permit other traffic as required by policy. Verify hit counts and test both permitted and denied flows before deployment.

IOS XE commands and verification

Syntax and feature availability can vary by device family and software release. Confirm platform support before applying configuration.

ip access-list extended WEB-FILTER
 permit tcp 192.168.10.0 0.0.0.255 host 192.0.2.20 eq 443
 deny ip any host 192.0.2.20
 permit ip any any
interface gi0/0/0
 ip access-group WEB-FILTER in
show access-lists
show ip interface gi0/0/0

Common mistakes and troubleshooting

• Check physical and interface state before changing higher-layer settings.
• Verify both ends agree on addressing, VLAN, encapsulation, and protocol parameters.
• Use operational show commands; configured text alone does not prove a feature is working.
• Change one variable at a time and verify the result.

Knowledge check

Choose one answer per question. Submit to see why the correct choice is right and why every other option is wrong. These are original practice questions, not Cisco exam questions.