Certifications / Cisco

Networking Basics: Configuring Extended Access Lists on Cisco Routers

by Team Nuggets
Networking Basics: Configuring Extended Access Lists on Cisco Routers picture: A
Published on March 21, 2019

The Quick Definition: Access lists, also known as access control lists, are configured on routers and used to regulate traffic entering and exiting networks. Access lists can be configured for all routed network protocols such as IP.

What is an extended access list?

Extended Access Control Lists (ACLs) act as the gatekeeper of your network. They either permit or deny traffic based on protocol, port number, source, destination, and time range. The range of customization is massive. In this example, you'll learn to use ACLs to block a specific source from accessing a targeted computer via specific ports.

How to Set Up an ACL

Imagine a computer ( in the illustration) attempting unauthorized access of via HTTP and HTTPS — and you want to stop that activity.  

You don't want to stop all traffic between these two IP addresses. That will cause a network outage. Instead, you want to restrict traffic only between the ports. HTTP is port 80. HTTPS is port 443.

The first thing you want to do is define the source IP address, which in this case is the unauthorized You'll first want to block all traffic from that IP address, which you can do with a wildcard mask, which acts as the filter within that source subgroup.

You can read all about how wildcard masks work in another post. In this example, you should know that entering here will block every octet of the IP address. In this case, that would deny every access attempt from the 192.168.1 subnet. The illustrated example above only has one host, though. If you enter "host", there's no mask request, and instead asks for a destination.

Setting the Destination

Now that the target is identified, it's time to input the restricted destination. In its current form, this ACL will deny all TCP traffic between and But you don't want to do that. This is where the port-specific functionality becomes important.

With these statements, you'll deny the ports access to your network.

Router1# conf t

Router1(config)# access-list 150 deny tcp host host eq 80

Router1(config)# access-list 150 deny tcp host host eq 443

The first statement blocks the target at port 80 of the destination. The second statement repeats the process for HTTPS, which is port 443. The keyword "EQ", meaning equal to, will allow for entry of specific ports.

To check the list, call up the list ("Show Access List"), which will return the two new statements.

Router1(config)#do sh access-list 150

Extended IP access list 150

10 deny tcp host host eq www

20 deny tcp host host eq 443

The first denies the first host from connecting with the second using port 80 (HTTP) and the second statement denies the same using port 443 (HTTPS). The ACL now includes the necessary instructions. But the configuration isn't over, yet, and is not ready to be applied to an interface.

Negating the "Deny All"

At the end of every ACL, there is an 'Implicit DENY ALL' statement. This statement does not show up in the configuration or when you run the 'show access-list' command. But, it is ALWAYS there. " So, if you only add the two deny statements covered above, that implicit deny  statement will block all access and cause a total network outage. To fix this, the ACL needs a permit statement, as well.

Bring up Access List 150 (the number assigned to this list) and add "Permit". Configure the permit to include IP from any source to any destination address. By allowing all variations within the statement, the "deny all" function is overruled and no longer causes that outage. Instead, only the two deny statements you created will now apply, and all other traffic will now be permitted.

Router1(config)#access-list 150 permit ip any any

Router1(config)#do sh access-list 150

Extended IP access list 150

10 deny tcp host host eq www

20 deny tcp host host eq 443

30 permit ip any any

Applying the ACL and Determining Direction

Cisco best practices indicate that this list should be applied as early in the sequence as possible. In this case, that's at Router 1. In the console, enter "int fa0/0" for the FastEthernet 0/0 interface and then the command "ip access-group". Then enter the relevant list number, which in this case is 150.

The console will then query "in" (inbound package) or "out" (outbound package), which requires determining the direction. The best possible advice here: be the router. Imagine each of your arms is an interface, one FastEthernet 0/0 and one serial 0/0, and ask which direction the traffic is coming from. In this case, the traffic is coming in the interface, which in this example indicates that the final entry of applying the access list should be "in".

Router1(config)# int fa0/0

Router1(config-if)#ip access-group 150 in

With the access list applied, host will no longer be able to reach host using either port 80 or 443, and your work is done!

CBT Nuggets ACL Courses

The following CBT Nuggets training course by trainer Jeremy Cioara contains two videos (66 and 67) that cover access lists in further detail.

Want to learn more about access lists on Cisco routers? Here's Jeremy with more on the topic!

Recommended Articles

Get CBT Nuggets IT training news and resources

I have read and understood the privacy policy and am able to consent to it.

© 2023 CBT Nuggets. All rights reserved.Terms | Privacy Policy | Accessibility | Sitemap | 2850 Crescent Avenue, Eugene, OR 97408 | 541-284-5522