1. ACCESS
CONTROL LIST

2. Access Control List
It provides Layer 3 security which controls the flow of traffic from one network to another.
Filters Packets (Packet Filtering Firewall)

3. Types of ACL
ACL
Numbered
Name
Standard
Extended
Standard
Extended

4. 192.168.1.0 should not communicate with 192.168.2.0 network
ACL - Network Diagram /8 S0 /8 S0
HYD
CHE
BAN S1 /8 S1 /8 E0
/24 E0
/24 E0
/24
1.2
1.3
1.4
2.2
2.3
2.4
3.2
3.3
3.4
LAN /24
LAN /24
LAN /24
should not communicate with network

5. Types of Access-list
Standard ACL
Extended ACL
Named ACL

6. Standard Access List
The access-list number range is 1 – 99
Can block a Network, Host and Subnet
Two way communication is stopped
All services are blocked.
Implemented closest to the destination. (Guideline)
Checks the source IP address.

7. Extended Access List
The access-list number range is 100 – 199
Can block a Network, Host, Subnet and Service
One way communication is stopped
Selected services can be blocked.
Checks source, destination IP address & port number.
Implemented closest to the source. (Guideline).

8. Terminology
Deny : Blocking a Network/Host/Subnet/Service
Permit : Allowing a Network/Host/Subnet/Service
Source Address : The address of the PC from where the request starts. Show Diagram
Destination address : The address of the PC where the request ends.
Inbound : Traffic coming into the interface
Outbound : Traffic going out of the interface

9. Terminology
Protocols : IP
- TCP
- UDP
- ICMP
Operators : eq (equal to)
neq (not equal to)
lt (less than)
gt (greater than)
Services : HTTP, FTP, TELNET, DNS, DHCP etc..

10. Wild Card Mask
Tells the router which addressing bits must match in the address of the ACL statement.
It’s the inverse of the subnet mask, hence is also called as Inverse mask.
A bit value of 0 indicates MUST MATCH (Check Bits)
A bit value of 1 indicates IGNORE (Ignore Bits)
Wild Card Mask for a Host will be always

11. Wild Card Mask
A wild card mask can be calculated using the formula :
Global Subnet Mask
– Customized Subnet Mask
Wild Card Mask
E.g. –

13. 192.168.1.0 should not communicate with 192.168.2.0 network
ACL - Network Diagram /8 S0 /8 S0
HYD
CHE
BAN S1 /8 S1 /8 E0
/24 E0
/24 E0
/24
1.1
1.2
1.3
2.1
2.2
2.3
3.1
3.2
3.3
LAN /24
LAN /24
LAN /24
should not communicate with network