CCNA Guide to Cisco Networking Fundamentals, Fourth Edition 10-1
Chapter 10
Access Lists
At a Glance
Instructor’s Manual Table of Contents
• Overview
• Objectives
• Teaching Tips
• Quick Quizzes
• Class Discussion Topics
• Additional Projects
• Additional Resources
• Key Terms
CCNA Guide to Cisco Networking Fundamentals, Fourth Edition 10-2
Lecture Notes
Overview
In this chapter, you will learn how to create and apply access lists to control both traffic
flow and network security. In the process, you will review the use and rules of access lists.
The chapter introduces the creation of standard and extended IP access lists and explains
how to apply them to router interfaces. This chapter also describes how to monitor and
verify access lists, create named access lists, and configure access lists via Security Device
Manager.
Chapter Objectives
• Describe the usage and rules of access lists
• Establish standard IP access lists
• Produce extended IP access lists
• Apply access lists to interfaces
• Monitor and verify access lists
• Create named access lists
• Use Security Device Manager to create standard and extended IP access lists
• Use Security Device Manager to create a router firewall
Teaching Tips
Access Lists: Usage and Rules
1. Define access lists as permit or deny statements that filter traffic based on the source
address, destination address, protocol type, and port number of a packet.
2. Mention that access lists are available for IP, IPX, AppleTalk, and many other
protocols.
Access List Usage
1. Explain that you can create a standard access list that examines a packet for the packet’s
2. Mention that with careful planning, you can create access lists that control which traffic
crosses particular links, and which segments of your network will have access to others.
CCNA Guide to Cisco Networking Fundamentals, Fourth Edition 10-3
Teaching
Tip
Although access lists can help with network security, they do not take the place
of more advanced security measures, such as firewalls. Access lists, combined
with dedicated firewalls at the edge of your network, provide the greatest
security.
Problems with Access Lists
2. Explain that the need to enter the list sequentially into the router also presents problems.
You cannot move individual statements once they are entered. When making changes,
you must remove the list, using the no access–list [list number]
command, and then retype the commands.
3. Mention that access lists begin working the second they are applied to an interface. You
can avoid this problem using the reload command.
Access List Rules
1. Describe the structure of a standard IP access list. The router applies each line in the
order in which you type it into the access list.
3. Explain that as a general rule, the lines with the most potential matches should be first
5. In summary, all access lists follow these rules:
a. Routers apply lists sequentially in the order in which you type them into the
router
Teaching
Tip
Many network administrators simplify this time-consuming process by creating
their access lists in a simple word processor, such as Notepad, and then copying
and pasting the access list into the router configuration.
CCNA Guide to Cisco Networking Fundamentals, Fourth Edition 10-4
Standard IP Access Lists
1. Explain that standard IP access lists filter network traffic based on the source IP address
3. Explain that routers use wildcards to determine which bits in an address will be
significant. Use Table 10-1 and Figures 10-4 through 10-7 to illustrate your explanation.
Standard IP Access List Examples
1. Explain that standard IP access lists permit or deny packets based only on the source
2. Mention that correct placement of a list is imperative. Use Figure 10-10 to illustrate
your explanation.
3. To view the access lists defined on your router, use the show access-lists
10-13 and 10-14 to illustrate your explanation.
5. Use Figure 10-15 to show how to apply the list as an outbound filter on FastEthernet0/0.
Monitoring Standard IP Access Lists
1. Describe the following three main commands available for monitoring access lists on
your router:
Teaching
Tip
Deciphering wildcard masks is relatively easy when an entire octet is either all 0s
(zero) or all 1s (255). It is more difficult when some bits in an octet are 0s and
some bits are 1s. This mixing of 0s and 1s in an octet is called partial masking.
Extended IP Access Lists
2. Mention that this granularity allows you to design extended IP access lists that permit or
Extended IP Access List Examples
1. Use Figures 10-18 through 10-20 to describe how to configure an extended IP access
list.
The “Established” Parameter
1. Explain that the established parameter permits traffic from any host on any network to
any destination, as long as the traffic was in response to a request initiated inside the
Monitoring Extended IP Access Lists
2. Explain that extended IP lists keep track of the number of packets that pass each line of
Quick Quiz 1
1. ____ are permit or deny statements that filter traffic based on the source address,
destination address, protocol type, and port number of a packet.
2. The access list ends with an implicit ____ statement, which blocks all packets that do
not meet the requirements of the access list.
3. Traffic coming in to the man in the router, through any of the interfaces, is considered
____ and needs to be filtered using incoming traffic filters.
4. ____ IP access lists filter network traffic based on the source IP address only.
Using Named Lists
1. Mention that in Cisco IOS versions 11.2 and above, names instead of numbers can be
used to identify lists. These are known as named access lists.
2. To name a standard IP access list, use the following syntax: RouterC(config)#ip
access–list standard [name]. To name an extended IP access list, use the
Teaching
Tip
Once the list is named, the permit or deny statement is entered. The
commands follow the same syntax as unnamed lists, but the beginning part of the
command is not included.
4. Describe the following advantages of using named lists:
a. Allows you to maintain security by using an easily identifiable access list
CCNA Guide to Cisco Networking Fundamentals, Fourth Edition 10-7
Controlling VTY Line Access
1. Explain that access lists are used for both traffic flow and security. One useful security
2. Mention that you must first create a standard IP access list that permits the management
workstation, for example: RouterA(config)#access–list 12 permit
3. To apply access list 12 to the VTY lines, you would use the following command:
4. Explain that the commands to restrict access to the VTY lines to network
0.0.0.255
RouterA(config)#line vty 0 4
RouterA(config–line)#access–class 13 in
Using Security Device Manager to Create Access Control Lists
1. Mention that using the SDM, an administrator can accomplish all the tasks that formerly
required use of the CLI interface.
3. Use Figures 10-25 through 10-32 to describe how to use SDM to create access control
lists.
Using Security Device Manager to Create a Router Firewall
1. Mention that unlike the CLI, the SDM does allow a router to be configured as a
firewall.
2. Use Figures 10-33 through 10-38 and Table 10-2 to describe how to use SDM to create
a router firewall.
CCNA Guide to Cisco Networking Fundamentals, Fourth Edition 10-8
Teaching
Tip
The Basic Firewall Configuration Wizard allows you to create a simple firewall
consisting of one trusted and one untrusted interface. The Advanced Firewall
Configuration Wizard allows you to configure a trusted, untrusted, and DMZ (or
demilitarized zone interfaces) firewall.
Quick Quiz 2
1. In Cisco IOS versions 11.2 and above, names instead of numbers can be used to identify
lists. These are known as ____.
2. Access lists are used for both traffic flow and security. One useful security feature of
access lists is restricting access to telnet on your router by controlling ____ line access.
3. The Cisco ____ Security Device Manager (SDM), introduced in Chapter 6, provides a
GUI-based configuration tool for Cisco devices.
4. True or False: Unlike the CLI, the SDM does allow a router to be configured as a
Class Discussion Topics
1. When should you use access lists?
2. What are the main advantages of using named access lists?
Additional Projects
1. Ask your students to read the following article “Cisco IOS access lists: 10 things you
2. Ask your students to read more about standard IP access lists and write a report
explaining how to log them. Use the following link as a starting point:
CCNA Guide to Cisco Networking Fundamentals, Fourth Edition 10-9
Additional Resources
1. Configuring IP Access Lists
3. Security: To Permit, or Not to Permit – Cisco IOS Access Control Lists (ACL). The
4. Standard Access Control List
5. Extended IP Access Lists
6. Access control list
Key Terms
➢ access lists Permit or deny statements that filter traffic based on criteria such as source
address, destination address, and protocol type.
➢ any A keyword used to represent all hosts or networks; replaces 0.0.0.0
255.255.255.255 in an access list.
➢ established A keyword that requires traffic to have originated inside the trusted
network.
➢ extended IP access lists IP access lists that filter traffic by source IP address,
destination IP address, protocol type, and port number.
