Access control lists

Standard and extended IPv4 ACLs, placement, and implicit deny.

An ACL is an ordered list of permit and deny lines. The first match wins. A hidden deny all sits at the end, so a list that only denies one host also blocks everyone else unless you permit the rest.

access-list 10 permit 172.16.10.0 0.0.0.255
interface GigabitEthernet0/0
 ip access-group 10 in

Standard ACLs match source address and usually sit close to the destination. Extended ACLs can match source, destination, and port, and usually sit close to the source. Always add a remark, and never edit a live ACL by deleting line 1 first.