Cisco IOS

ACL Builder

Build standard and extended ACLs with a visual form

What is an ACL?

Access Control Lists (ACLs) are ordered rules that match traffic and decide whether to permit or deny it. They live on interfaces and are checked from top to bottom.

Standard ACLs match source IP only, good for simple allow/deny of networks.
Extended ACLs match source, destination, protocol and ports for fine‑grained control.
ACLs are processed top‑down with an implicit deny at the end of every list.
Apply ACLs inbound or outbound using ip access-group NAME in|out under an interface.

ACL Design Tips

For standard ACLs, place them close to the destination network.
For extended ACLs, place them close to the source to drop unwanted traffic early.
Group related rules together and keep numbering consistent across devices when possible.
Always permit important management traffic (SSH, monitoring) before broad deny statements.

Common Match Examples

Goal	Example line
Allow a subnet	permit 192.168.10.0 0.0.0.255
Deny guest VLAN	deny 10.50.0.0 0.0.255.255
Deny HTTP to server	deny tcp any 10.10.10.10 0.0.0.0 eq 80
Permit DNS	permit udp any any eq 53

ACL Type

ACL Name/Number

Rules (one per line: action,source[,dest,protocol,port])

Apply to Interface

Direction

conf t
ip access-list standard BLOCK-GUEST
 permit 192.168.10.0 0.0.0.255
 deny 192.168.20.0 0.0.0.255
 permit any
exit
interface Gi0/0
 ip access-group BLOCK-GUEST in
end

💡 Standard ACLs → place close to destination. Extended ACLs → place close to source.