1. ACCESS CONTROL LIST Slides Prepared By Adeel Ahmed,
Updated By, Syed Ameen Quadri.

2. Access Control List
It is a Layer 3 security which controls the flow of traffic from one router to another.
It is also called as Packet Filtering Firewall.

3. 1.0 should not communicate with 2.0 network
ACL - Network Diagram /8 S0 /8 S0
JIZ S1 /8
JED S1 /8
RYD E0
/24 E0
/24 E0
/24
1.1
1.2
1.3
2.1
2.2
2.3
3.1
3.2
3.3
LAN /24
LAN /24
LAN /24
1.0 should not communicate with 2.0 network

4. Types of Access-list
Standard ACL
Extended ACL
Named ACL

5. Standard Access List
The access-list number lies between 1 – 99
Can block a Network, Host and Subnet
Two way communication is stopped
All services are blocked.
Implemented closest to the destination. (Guideline)

6. Extended Access List
The access-list number lies between 100 – 199
Can block a Network, Host, Subnet and Service
One way communication is stopped
Selected services can be blocked.
Implemented closest to the source. (Guideline)

7. Terminology
Deny : Blocking a Network/Host/Subnet/Service
Permit : Allowing a Network/Host/Subnet/Service
Source Address : The address of the PC from where the request starts. Show Diagram
Destination address : The address of the PC where the request ends.
Inbound : Traffic coming into the interface
Outbound : Traffic going out of the interface

8. Terminology
Protocols : IP
- TCP
- UDP
- ICMP
Operators : eq (equal to)
neq (not equal to)
lt (less than)
gt (greater than)
Services : HTTP, FTP, TELNET, DNS, DHCP etc..

9. Wild Card Mask
Tells the router which addressing bits must match in the address of the ACL statement.
It’s the inverse of the subnet mask, hence is also called as Inverse mask.
A bit value of 0 indicates MUST MATCH (Check Bits)
A bit value of 1 indicates IGNORE (Ignore Bits)
Wild Card Mask for a Host will be always

10. Wild Card Mask
A wild card mask can be calculated using the formula :
Global Subnet Mask
– Customized Subnet Mask
Wild Card Mask
E.g. –

11. 1.0 should not communicate with 2.0 network
ACL - Network Diagram /8 S0 /8 S0
JIZ S1 /8
JED S1 /8
RYD E0
/24 E0
/24 E0
/24
1.1
1.2
1.3
2.1
2.2
2.3
3.1
3.2
3.3
LAN /24
LAN /24
LAN /24
1.0 should not communicate with 2.0 network