IP Addresses and Services Configuration Guide for Cisco 8000 Series Routers, IOS XR Releases

PDF

IP Addresses and Services Configuration Guide for Cisco 8000 Series Routers, IOS XR Releases

IPv4 ACLs

Updated: August 12, 2026

Want to summarize with AI?

This topic introduces IPv4 access control lists (ACLs) on the Cisco 8000 Series Router, which you can apply in the ingress or egress direction on interfaces to filter IPv4 traffic.

You can configure IPv4 access control lists (ACLs) in the ingress or egress direction on interfaces of the Cisco 8000 Series Router. IPv4 ingress and egress ACLs are subject to platform-specific configuration guidelines, restrictions, and per-NPU scale limits.

Configuration guidelines and restrictions for ingress IPv4 ACLs

These restrictions apply to IPv4 ingress ACLs:

Ingress IPv4 ACLs are supported on all interfaces except management interfaces.
In fixed systems, the maximum number of ACLs allowed per NPU is 45. In distributed systems, the maximum number of ACLs allowed per NPU is 30.
Packet Length is not supported.
From Release 7.8.1 onwards, ACL logging with input interface (using the log-input keyword) is supported.
The maximum number of ingress ACLs for Cisco 8011-4G24Y4H-I is 510.

Configuration guidelines and restrictions for egress IPv4 ACLs

These restrictions apply to IPv4 egress ACLs:

ACL is not supported on Management interface on egress direction.
ACL logging is not supported on egress direction.
The maximum number of egress ACLs for Cisco 8011-4G24Y4H-I router is 45.

Supported ACLs per NPU

This table lists the supported ACLs per NPU.


System	ASIC	Ingress ACL per NPU	Egress ACL per NPU
Fixed	Q100	381	45
	Q200	381	45
	K100	510	510
	P100	510 (Release 24.3.1) 1020 (Release 24.4.1)	510 (Release 24.3.1) 1020 (Release 24.4.1)
Modular	Q100	254	30
	Q200	254	30
	P100	510 (Release 24.3.1) 1020 (Release 24.4.1)	510 (Release 24.3.1) 1020 (Release 24.4.1)
Centralized	Q200	381	45

Configure an ingress IPv4 ACL

Use this procedure to configure an ingress IPv4 ACL on a HundredGigE interface.

Procedure

Enter global configuration mode. Configure an ingress IPv4 ACL on a HundredGigE interface.
Example:
```
Router# configure terminal
```

Configure the HundredGigE interface with an IPv4 address and enable it.

Example:

Router(config)# interface HundredGigE 0/0/0/0
Router(config-if)# ipv4 address 192.0.2.1 255.255.255.0
Router(config-if)# no shut
Router(config-if)# commit
Router(config-if)# exit

Verify that the interface is up. Confirm the interface status shows Up for both Status and Protocol.

Example:

Router(config)# do show ipv4 interface brief
Thu Jul 11 08:46:51.930 UTC
Interface                  IP-Address      Status          Protocol Vrf-Name
HundredGigE 0/0/0/0         192.0.2.1        Up              Up       default

Create an IPv4 ingress access control list (ACL) named V4-ACL-INGRESS and add rules.

Example:

Router(config)# ipv4 access-list V4-ACL-INGRESS
Router(config-ipv4-acl)# 10 permit tcp 192.0.2.2 255.255.255.0 any
Router(config-ipv4-acl)# 20 deny udp any any
Router(config-ipv4-acl)# 30 permit ipv4 192.0.2.64 255.255.255.0 any
Router(config-ipv4-acl)# commit
Router(config-ipv4-acl)# exit

Verify the ACL creation. Confirm the ACL V4-ACL-INGRESS and its rules are listed.

Example:

Router(config)# do show access-lists ipv4

Thu Jul 11 09:01:50.445 UTC
HundredGigE 0/0/0/0 is Up, ipv4 protocol is Up
  Vrf is default (vrfid 0x60000000)
  Internet address is 192.0.2.1/24
  MTU is 1514 (1500 is available to IP)
  Helper address is not set
  Directed broadcast forwarding is disabled
  Outgoing access list is not set
  Inbound  common access list is not set, access list is V4-ACL-INGRESS
  Proxy ARP is disabled
  ICMP redirects are never sent
  ICMP unreachables are always sent
  ICMP mask replies are never sent
  Table Id is 0xe0000000

Apply the ingress ACL to the HundredGigE interface.

Router(config)# interface HundredGigE 0/0/0/0
Router(config-if)# ipv4 access-group V4-ACL-INGRESS ingress
Router(config-if)# commit
Router(config-if)# exit

Verify that the ingress ACL has been successfully applied to the interface.
Example:
```
Router(config)# do show ipv4 interface
```
You have successfully configured an IPv4 ingress ACL on a HundredGigE interface.

Configure an egress IPv4 ACL

Use this procedure to configure an egress IPv4 ACL on a HundredGigE interface.

Procedure

Enter global configuration mode. Configure an egress IPv4 ACL on a HundredGigE interface.
Example:
```
Router# configure terminal
```

Configure the HundredGigE interface with an IPv4 address and enable it.

Example:

Router(config)# interface HundredGigE 0/0/0/0
Router(config-if)# ipv4 address 198.51.100.1 255.255.255.0
Router(config-if)# no shut
Router(config-if)# commit
Router(config-if)# exit

Verify that the interface is up. Confirm the interface status shows Up for both Status and Protocol.

Example:

Router(config)# do show ipv4 interface brief
Thu Jul 11 08:55:44.824 UTC
Interface                      IP-Address      Status          Protocol Vrf-Name
HundredGigE 0/0/0/0         192.0.2.1           Up              Up       default
HundredGigE 0/0/0/1         198.51.100.1        Up              Up       default

Create an IPv4 egress access control list (ACL) named V4-ACL-EGRESS and add rules.

Example:

Router(config)# ipv4 access-list V4-ACL-EGRESS
Router(config-ipv4-acl)# 10 permit ipv4 203.0.113.1 255.255.255.0 192.0.2.1 0.255.255.255
Router(config-ipv4-acl)# 20 deny ipv4 any any
Router(config-ipv4-acl)# commit
Router(config-ipv4-acl)# exit

Verify the ACL creation. Confirm the ACL V4-ACL-EGRESS and its rules are listed.

Example:

Router(config)# do show access-lists ipv4
Thu Jan 25 10:25:19.896 IST
ipv4 access-list V4-ACL-EGRESS
 10 permit ipv4 203.0.113.1 255.255.255.0 192.0.2.1 255.255.255.0
 20 deny ipv4 any any

Apply the egress ACL to the HundredGigE interface.

Router(config)# interface HundredGigE 0/0/0/1
Router(config-if)# ipv4 access-group V4-ACL-EGRESS egress
Router(config-if)# commit
Router(config-if)# exit

Verify that the egress ACL has been successfully applied to the interface.
Example:
```
Router(config)# do show ipv4 interface
```
You have successfully configured an IPv4 egress ACL on a HundredGigE interface. For more information on logging messages, see IP access list logging messages.

Need help?

Open a support case

(Requires a Cisco Service Contract)

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.