This section describes how access control lists evaluate packet fields and apply matching permit or deny statements to control network traffic.
An ACL is a sequential list consisting of permit and deny statements that apply to IP addresses and upper-layer IP protocols. The ACL has a name by which it is referenced. Many software commands accept an ACL as part of their syntax.
An ACL can be configured and named; however, it does not take effect until the ACL is referenced by a command that accepts an ACL. Multiple commands can reference the same ACL. An ACL can control traffic arriving at the router or leaving the router, but not traffic originating at the router.
Source address and destination address are two of the most typical fields in an IP packet on which to base an ACL. Specify source addresses to control packets from certain networking devices or hosts. Specify destination addresses to control packets that are sent to certain networking devices or hosts.
You can also filter packets on the basis of transport layer information, such as whether the packet is a TCP, UDP, Internet Control Message Protocol (ICMP), or Internet Group Management Protocol (IGMP) packet.
ACL Workflow
The following image illustrates the workflow of an ACL.
Helpful Hints for Creating ACLs
Consider the following when creating ACLs:
Guidelines and Restrictions for Configuring ACLs
You must be aware of the following restrictions for configuring ACLs.
Summary
The key components involved in how access control lists work are:
-
ACL entries: Define permit and deny statements for network traffic.
-
Interfaces: Apply access lists to inbound or outbound traffic.
-
Traffic flows: Match configured rules before the device permits or denies packets.
Workflow
The how access control lists work process involves the following stages:
- An ACL is a sequential list consisting of permit and deny statements that apply to IP addresses and upper-layer IP protocols. The ACL has a name by which it is referenced. Many software commands accept an ACL as part of their syntax.
- An ACL can be configured and named; however, it does not take effect until the ACL is referenced by a command that accepts an ACL. Multiple commands can reference the same ACL. An ACL can control traffic arriving at the router or leaving the router, but not traffic originating at the router.
- Source address and destination address are two of the most typical fields in an IP packet on which to base an ACL. Specify source addresses to control packets from certain networking devices or hosts. Specify destination addresses to control packets that are sent to certain networking devices or hosts.
- You can also filter packets on the basis of transport layer information, such as whether the packet is a TCP, UDP, Internet Control Message Protocol (ICMP), or Internet Group Management Protocol (IGMP) packet.
- ACL Workflow
- The following image illustrates the workflow of an ACL.
- ACL Workflow
- Helpful Hints for Creating ACLs
Result
The process determines how matching traffic is permitted, denied, or forwarded.