An Access Control List (ACL) permits or denies traffic based on IP addresses, protocols and ports. Cisco ACLs are processed top-down and end with an implicit deny.

Standard ACL example

access-list 10 permit 192.168.10.0 0.0.0.255
interface gigabitEthernet 0/0
 ip access-group 10 in

Named extended ACL example

ip access-list extended USERS-TO-WEB
 permit tcp 192.168.10.0 0.0.0.255 any eq 80
 permit tcp 192.168.10.0 0.0.0.255 any eq 443
 deny ip any any log
interface gigabitEthernet 0/1
 ip access-group USERS-TO-WEB in

This is a lab example only. Match the interface, direction and rule order to the real topology.

Verification

show access-lists
show ip interface gigabitEthernet 0/1

Practice

In a lab subnet, permit HTTP/HTTPS for one network and deny other IP traffic. Review existing access paths before applying an ACL.