Access Lists

Access lists are a set of conditions that permit or deny access to or through a routers interface.

Range            Usage

• 1-99              IP Standard
• 1300-1999      IP Standard (Expanded Range)
• 100-199IP      Extended
• 2000-2699IP   Extended (Expanded Range)

Access lists can be applied to multiple interfaces but there can only be one access list per protocol per direction per interface.

Use the term ‘access-class’ if applying to console/aux/vty lines

• show ip access-lists
• show access-list 1

Access lists are applied to interfaces:

• Router(config)#access-list 1 permit 172.16.5.2
• Router(config)#interface e0
• Router(config-if)#ip access-group 1 in

Standard IP access lists check only the source address of the packet and permits or denies the entire TCP/IP suite. You cannot choose a particular port or application to block.


Cisco recommends that they are placed as close to the destination as possible.

Router(config)#access-list{number 1-99}{permit/deny}{source address}access-list 10 permit 172.16.5.2  address can be a host or network

These allow for a lot more granularity when filtering IP traffic. They can filter packets based upon source or destination, a particular IP protocol and port number.


Cisco recommends that they are placed as close to the source as possible.


Router(config)#access-list {number 100-99}{permit/deny}{protocol} {source}{destination}{port}access-list 112 permit tcp host 172.16.5.2 host 172.16.10.2 eq www

Access lists applied to inbound interfaces save the router having to process the packet, denied packets will be dropped at the interface. Outbound access lists will be processed by the router and then dropped at the outbound interface if they match the access list.

• Router(config)#ip access-list {standard/extended} name
• Router(config)#ip access-list extended no_ftp

Wildcard masks tell the router which parts of the address to look at and which to disregard.

access-list 12 permit 172.16.5.0 0.0.0.255


This would permit any host on network 172.16.5.x. In order to work out a wildcard mask simply write out the mask in full and then take that number away from 255.

• Number  255 255 255 255
• Mask      255 255 192 0
• Equals     0    0    63  255