Cisco CCNA Certification: Access List Details You Must Know!

    June 22, 2006

To pass the CCNA exam, you have to be able to write and troubleshoot access lists. As you climb the ladder toward the CCNP and CCIE, youll see more and more uses for ACLs.

Therefore, you had better know the basics!

The use of “host” and “any” confuses some newcomers to ACLs, so lets take a look at that first.

It is acceptable to configure a wildcard mask of all ones or all zeroes. A wildcard mask of means the address specified in the ACL line must be matched exactly a wildcard mask of means that all addresses will match the line.

Wildcard masks have the option of using the word host to represent a wildcard mask of Consider a configuration where only packets from IP source should be allowed and all other packets denied. The following ACLs both do that.

R3#conf t

R3(config)#access-list 6 permit

R3(config)#conf t

R3(config)#access-list 7 permit host

The keyword any can be used to represent a wildcard mask of

R3(config)#access-list 15 permit any

Another often overlooked detail is the order of the lines in an ACL. Even in a two- or three-line ACL, the order of the lines in an ACL is vital.

Consider a situation where packets sourced from /24 will be denied, but all others will be permitted. The following ACL would do that.

R3#conf t

R3(config)#access-list 15 deny

R3(config)#access-list 15 permit any

The previous example also illustrates the importance of configuring the ACL with the lines in the correct order to get the desired results. What would be the result if the lines were reversed?

R3#conf t

R3(config)#access-list 15 permit any

R3(config)#access-list 15 deny

If the lines were reversed, traffic from /24 would be matched against the first line of the ACL. The first line is “permit any”, meaning all traffic is permitted. The traffic from matches that line, the traffic is permitted, and the ACL stops running. The statement denying the traffic from is never run.

The key to writing and troubleshoot access lists is to take just an extra moment to read it over and make sure its going to do what you intend it to do. Its better to realize your mistake on paper instead of once the ACLs been applied to an interface!

Add to | DiggThis | Yahoo! My Web | Furl

Chris Bryant, CCIE #12933, is the owner of The Bryant Advantage (, home of FREE CCNA and CCNP tutorials and daily exam questions, as well as The Ultimate CCNA and CCNP Study Packages.

For a FREE copy of his latest e-books, “How To Pass The CCNA” or “How To Pass The CCNP”, and for free daily exam question, visit the website and download your copies!