Configuring Standard Access Lists

Standard Access Control Lists represent the simplest and fastest packet filtering tool available on network routers. Because standard ACLs only inspect a single field inside the IP header—the source IP address—they require minimal processor overhead to evaluate. This makes them ideal for quickly blocking rogue host addresses or isolating entire departmental subnets.

However, because standard ACLs cannot inspect the destination address or application port numbers, an incorrect placement decision can accidentally disconnect users from services they need. In this chapter, you will learn how to configure both numbered and named standard ACLs, master wildcard masks, and follow the universal placement guideline.

Numbered versus Named Access Lists

On enterprise routers, access lists can be defined using legacy numeric ranges or modern alphanumeric names. Understanding both formats is essential for certification exams and production network troubleshooting.

In the legacy numbered scheme, the router recognizes the type of ACL based solely on its identification number:

• Standard IPv4 ACL Numbers: 1 to 99 and expanded range 1300 to 1999.
• Extended IPv4 ACL Numbers: 100 to 199 and expanded range 2000 to 2699.

While numbered ACLs are quick to type, modern network engineers strongly prefer Named Access Lists. Named ACLs allow you to assign descriptive labels such as ip access-list standard BLOCK_CONTRACTORS. Even better, named ACLs support line number editing, allowing you to insert or delete specific rules without deleting the entire list and re-typing everything from scratch.

Wildcard Masks: The Inverse Bit Logic

Unlike interface IP configurations that use standard subnet masks (such as 255.255.255.0), Cisco access control lists utilize Wildcard Masks (often called inverse masks). A wildcard mask uses binary 0 bits to represent "must match exactly," and binary 1 bits to represent "ignore this bit (do not care)."

To calculate a wildcard mask for any standard subnet, subtract the subnet mask from 255.255.255.255:

  255.255.255.255 (Global Wildcard)
- 255.255.255.0   (Subnet Mask /24)
-----------------
    0.  0.  0.255 (Wildcard Mask)

For an individual single host address, every bit must match exactly, yielding a wildcard mask of 0.0.0.0. To simplify typing, router operating systems provide convenient shorthand keywords:

• host 192.168.1.50 is equivalent to 192.168.1.50 0.0.0.0.
• any is equivalent to 0.0.0.0 255.255.255.255.

The Golden Rule of Standard ACL Placement

Where should you apply a Standard Access Control List in your network topology? The universal rule is: Place Standard ACLs as close to the destination as possible.

Why close to the destination? Because standard ACLs only filter by source address! If you place a standard ACL blocking PC1 close to the source on Router 1, you block PC1 from communicating with everything on the other side of Router 1, including legitimate local printers, shared file servers, and external internet services. By placing the standard ACL close to the destination (on the interface leading directly to the protected server), you restrict access to that specific server while allowing PC1 to access other network destinations unhindered.

Hands-On Lab Practice

In this lab exercise, you will configure a standard access control list on an office distribution router. Your goal is to block an untrusted workstation (192.168.10.99) from accessing a human resources database server (192.168.30.50), while permitting normal workstations on the 192.168.10.0/24 subnet to access the database without restriction.

Follow the configuration checklist carefully. Verify that the untrusted workstation is blocked with ICMP administratively prohibited messages, and confirm that authorized peers continue to enjoy full database connectivity.