The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.
Access control lists (ACLs) perform packet filtering to control the movement of packets through a network. Packet filtering provides security by limiting the access of traffic into a network, restricting user and device access to a network, and preventing traffic from leaving a network. IP access lists reduce the chance of spoofing and denial-of-service attacks, and allow dynamic, temporary user-access through a firewall.
The IP Named Access Control Lists feature gives network administrators the option of using names to identify their access lists.
This module describes IP named access lists and how to configure them.
Your software release may not support all the features documented in this module. For the latest caveats and feature information, see Bug Search Tool and the release notes for your platform and software release. To find information about the features documented in this module, and to see a list of the releases in which each feature is supported, see the feature information table at the end of this module.
Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to www.cisco.com/go/cfn. An account on Cisco.com is not required.
Information About IP Named Access Control Lists
Access control lists (ACLs) perform packet filtering to control the movement of packets through a network. Packet filtering provides security by limiting the access of traffic into a network, restricting user and device access to a network, and preventing traffic from leaving a network. IP access lists reduce the chance of spoofing and denial-of-service attacks, and allow dynamic, temporary user-access through a firewall.
IP access lists can also be used for purposes other than security, such as to control bandwidth, restrict the content of routing updates, redistribute routes, trigger dial-on-demand (DDR) calls, limit debug output, and identify or classify traffic for quality of service (QoS) features.
An access list is a sequential list that consists of at least one permit statement and possibly one or more deny statements. In the case of IP access lists, these statements can apply to IP addresses, upper-layer IP protocols, or other fields in IP packets.
Access lists are identified and referenced by a name or a number. Access lists act as packet filters, filtering packets based on the criteria defined in each access list.
After you configure an access list, for the access list to take effect, you must either apply the access list to an interface (by using the ip access-group command), a vty (by using the access-class command), or reference the access list by any command that accepts an access list. Multiple commands can reference the same access list.
In the following configuration, an IP access list named branchoffices is configured on Fast Ethernet interface 0/1/0 and applied to incoming packets. Networks other than the ones specified by the source address and mask pair cannot access Fast Ethernet interface 0/1/0. The destinations for packets coming from sources on network 172.16.7.0 are unrestricted. The destination for packets coming from sources on network 172.16.2.0 must be 172.31.5.4.
ip access-list extended branchoffices 10 permit 172.16.7.0 0.0.0.3 any 20 permit 172.16.2.0 0.0.0.255 host 172.31.5.4 ! interface fastethernet 0/1/0 ip access-group branchoffices in
All access lists must be identified by a name or a number. Named access lists are more convenient than numbered access lists because you can specify a meaningful name that is easier to remember and associate with a task. You can reorder statements in or add statements to a named access list.
Named access lists support the following features that are not supported by numbered access lists:
![]() Note |
Not all commands that accept a numbered access list will accept a named access list. For example, vty uses only numbered access lists. |
The following rules apply to access lists:
The following tips will help you avoid unintended consequences and help you create more efficient, useful access lists.
You can apply access lists to the inbound or outbound interfaces of a device. Applying an access list to an inbound interface controls the traffic that enters the interface and applying an access list to an outbound interface controls the traffic that exits the interface.
When software receives a packet at the inbound interface, the software checks the packet against the statements that are configured for the access list. If the access list permits packets, the software processes the packet. Applying access lists to filter incoming packets can save device resources because filtered packets are discarded before entering the device.
Access lists on outbound interfaces filter packets that are transmitted (sent) out of the interface. You can use the TCP Access Control List (ACL) Splitting feature of the Rate-Based Satellite Control Protocol (RBSCP) on the outbound interface to control the type of packets that are subject to TCP acknowledgment (ACK) splitting on an outbound interface.
You can reference an access list by using a debug command to limit the amount of debug logs. For example, based on the filtering or matching criteria of the access list, debug logs can be limited to source or destination addresses or protocols.
You can use access lists to control routing updates, dial-on-demand (DDR), and quality of service (QoS) features.
How to Configure IP Named Access Control Lists
You can create an IP named access list to filter source addresses and destination addresses or a combination of addresses and other IP fields. Named access lists allow you to identify your access lists with an intuitive name.
1. enable
2. configure terminal
3. ip access-list extended name
4. remark remark
5. deny protocol [source source-wildcard] {any | host {address | name} | object-group object-group-name} {destination [destination-wildcard] {any | host {address | name} | object-group object-group-name} [log]
6. remark remark
7. permit protocol [source source-wildcard] {any | host {address | name} | object-group object-group-name} {destination [destination-wildcard] {any | host {address | name} | object-group object-group-name} [log]
8. Repeat Steps 4 through 7 to specify more statements for your access list.
9. end
10. show ip access-lists
The following is sample output from the show ip access-lists command:
Device# show ip access-lists acl1 Extended IP access list acl1 permit tcp any 192.0.2.0 255.255.255.255 eq telnet deny tcp any any deny udp any 192.0.2.0 255.255.255.255 lt 1024 deny ip any any log
1. enable
2. configure terminal
3. interface type number
4. ip access-group {access-list-number | access-list-name} {in | out}
5. end
Command or Action | Purpose | |
---|---|---|
Step 1 | enable Example: Device> enable |
Enables privileged EXEC mode. |
Step 2 | configure terminal Example: Device# configure terminal |
Enters global configuration mode. |
Step 3 | interface type number Example: Device(config)# interface fastethernet 0/0/0 |
Specifies an interface and enters interface configuration mode. |
Step 4 | ip access-group {access-list-number | access-list-name} {in | out} Example: Device(config-if)# ip access-group acl1 in |
Applies the specified access list to the inbound interface. |
Step 5 | end Example: Device(config-if)# end |
Exits interface configuration mode and returns to privileged EXEC mode. |
Configuration Examples for IP Named Access Control Lists
Device# configure terminal Device(config)# ip access-list extended acl1 Device(config-ext-nacl)# remark protect server by denying sales access to the acl1 network Device(config-ext-nacl)# deny ip 192.0.2.0 0.0.255.255 host 192.0.2.10 log Device(config-ext-nacl)# remark allow TCP from any source to any destination Device(config-ext-nacl)# permit tcp any any
Device# configure terminal Device(config)# interface fastethernet 0/0/0 Device(config-if)# ip access-group acl1 in
Related Topic |
Document Title |
---|---|
Cisco IOS commands |
|
Security commands |
|
Description |
Link |
---|---|
The Cisco Support and Documentation website provides online resources to download documentation, software, and tools. Use these resources to install and configure the software and to troubleshoot and resolve technical issues with Cisco products and technologies. Access to most tools on the Cisco Support and Documentation website requires a Cisco.com user ID and password. |
The following table provides release information about the feature or features described in this module. This table lists only the software release that introduced support for a given feature in a given software release train. Unless noted otherwise, subsequent releases of that software release train also support that feature.
Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to www.cisco.com/go/cfn. An account on Cisco.com is not required.
Feature Name |
Releases |
Feature Information |
---|---|---|
IP Named Access Control Lists |
Access control lists (ACLs) perform packet filtering to control the movement of packets through a network. Packet filtering provides security by limiting traffic into a network, restricting user and device access to a network, and preventing traffic from leaving a network. IP access lists reduce the chance of spoofing and denial-of-service attacks, and allow dynamic, temporary user-access through a firewall. |