Intrusion Detection System (IDS) — Types, How It Works, IDS vs IPS
An IDS watches traffic and alerts on suspicious activity; an IPS sits inline and blocks it. Network vs…
An extended ACL filters traffic on source address, destination address, protocol and port number. A standard ACL can only match the source address, which makes it far too blunt for most real filtering.
| Standard ACL | Extended ACL | |
|---|---|---|
| Numbered range | 1–99, 1300–1999 | 100–199, 2000–2699 |
| Matches on | Source IP only | Source, destination, protocol, port, flags |
| Place it | Close to the destination | Close to the source |
The placement rule follows from the capability. A standard ACL placed near the source would block that source from reaching everything, since it cannot distinguish destinations. An extended ACL can be specific, so you place it near the source and drop unwanted traffic before it consumes bandwidth crossing the network.
Syntax
access-list <100-199> {permit|deny} <protocol> <source> <wildcard> [operator port]
<destination> <wildcard> [operator port] [log]| Element | Values |
|---|---|
| Protocol | ip, tcp, udp, icmp, ospf, eigrp, gre, esp |
| Address shorthand | any = 0.0.0.0 255.255.255.255; host x.x.x.x = a single address |
| Port operators | eq, neq, lt, gt, range |
established | TCP only — matches packets with ACK or RST set |
log | Generates a syslog message on match |
Wildcard masks
An ACL wildcard is the inverse of a subnet mask. A 0 bit means “must match”; a 1 bit means “ignore”.
| Subnet mask | Wildcard | Matches |
|---|---|---|
| 255.255.255.255 | 0.0.0.0 | One host |
| 255.255.255.0 (/24) | 0.0.0.255 | 256 addresses |
| 255.255.252.0 (/22) | 0.0.3.255 | 1024 addresses |
| 255.255.0.0 (/16) | 0.0.255.255 | 65,536 addresses |
| 0.0.0.0 | 255.255.255.255 | Everything (any) |
Quick conversion: subtract each octet of the subnet mask from 255.
Worked Examples
Allow HTTP and HTTPS to a web server, deny everything else to it
Router(config)# access-list 101 permit tcp any host 10.10.10.50 eq 80
Router(config)# access-list 101 permit tcp any host 10.10.10.50 eq 443
Router(config)# access-list 101 deny ip any host 10.10.10.50
Router(config)# access-list 101 permit ip any any
Router(config)# interface GigabitEthernet0/1
Router(config-if)# ip access-group 101 inThe final permit ip any any matters. Without it, the implicit deny at the end of every ACL blocks all remaining traffic on that interface.
Block one subnet from reaching another, allow the rest
Router(config)# access-list 102 deny ip 192.168.20.0 0.0.0.255 192.168.10.0 0.0.0.255
Router(config)# access-list 102 permit ip any anyAllow outbound web browsing, block unsolicited inbound
Router(config)# access-list 110 permit tcp any any established
Router(config)# access-list 110 permit udp any eq 53 any
Router(config)# access-list 110 permit icmp any any echo-reply
Router(config)# access-list 110 deny ip any any log
Router(config)# interface GigabitEthernet0/0
Router(config-if)# ip access-group 110 inBe clear about what established does: it checks only that the ACK or RST flag is set. It does not verify that a matching outbound connection exists, so a crafted packet with ACK set passes. For a real perimeter, use a stateful firewall or Zone-Based Firewall rather than an established ACL.
Restrict management access
Router(config)# ip access-list standard MGMT-HOSTS
Router(config-std-nacl)# permit 10.10.99.0 0.0.0.255
Router(config)# line vty 0 15
Router(config-line)# access-class MGMT-HOSTS in
Router(config-line)# transport input sshNote access-class, not ip access-group — VTY lines use a different command.
Named Extended ACLs — Use These
Named ACLs support sequence numbers, which means you can insert and remove individual lines. With a numbered ACL, removing one line deletes the entire list on older IOS — a genuinely dangerous operation on a production router.
Router(config)# ip access-list extended WEB-FILTER
Router(config-ext-nacl)# 10 permit tcp any host 10.10.10.50 eq 443
Router(config-ext-nacl)# 20 permit tcp any host 10.10.10.50 eq 80
Router(config-ext-nacl)# 30 deny ip any any log
! Insert a rule between existing entries
Router(config-ext-nacl)# 15 permit tcp any host 10.10.10.50 eq 8443
! Remove a single line
Router(config-ext-nacl)# no 20
Router(config)# interface GigabitEthernet0/1
Router(config-if)# ip access-group WEB-FILTER inLeave gaps of 10 between sequence numbers so there is room to insert later.
How ACLs Are Evaluated
- Rules are checked top to bottom.
- First match wins — evaluation stops there.
- If nothing matches, the implicit
deny ip any anyat the end drops the packet.
Order is therefore everything. A broad permit near the top makes every specific deny below it unreachable. Write specific rules first, general ones last.
Router# show access-lists
Router# show ip access-lists WEB-FILTER
Router# show ip interface GigabitEthernet0/1 | include access list
Router# clear access-list countersshow access-lists displays a hit counter per line. A rule with zero hits is either unreachable because of ordering, or unnecessary — either way it is worth investigating.
Inbound vs Outbound
in | out | |
|---|---|---|
| Applied | As the packet enters the interface, before routing | After routing, as the packet leaves |
| Efficiency | Better — denied packets never get routed | Router does the routing work first |
| Filters traffic the router itself generates | No | No |
Prefer in where you have the choice. Note that neither direction filters traffic originated by the router itself — that requires a control-plane policy.
You can apply one ACL per direction per protocol per interface. Not two inbound.
Mistakes That Cause Outages
Forgetting the implicit deny. You permit what you wanted and lock out everything else. Always finish with an explicit rule stating your intent — even if it is permit ip any any.
Editing a numbered ACL remotely. On older IOS, no access-list 101 deletes the whole list, and if it was permitting your SSH session, you are now locked out. Use named ACLs, and use reload in 10 as a safety net before risky changes.
Wrong direction or interface. Think about which way the packet is travelling relative to the interface, not relative to you.
Blocking necessary control traffic. A deny-all ACL that forgets ICMP breaks path MTU discovery, so large packets are silently dropped while ping works. Permit icmp any any packet-too-big and unreachable at minimum.
Blocking DHCP or routing protocols. An ACL on an interface carrying OSPF or EIGRP must permit those protocols, or the adjacency drops the moment you apply it.
Frequently Asked Questions
What is the difference between a standard and an extended ACL?
A standard ACL matches only the source address. An extended ACL matches source, destination, protocol and port. Standard ACLs go near the destination; extended ACLs go near the source.
Why is there an implicit deny at the end?
It is a fail-closed default — anything not explicitly permitted is denied. It does not appear in show access-lists, which is why people forget it exists.
Can I have two ACLs on one interface?
One per direction per protocol. You can have one inbound and one outbound, but not two inbound.
How do I edit an ACL without removing it?
Use a named ACL and reference the sequence numbers to insert or delete individual lines. Numbered ACLs support sequence numbers on modern IOS too, but named is the safer habit.
Does an ACL filter traffic the router itself generates?
No. Interface ACLs apply to transit traffic only. To filter traffic destined to the router’s own control plane, use Control Plane Policing (CoPP), and for VTY access use access-class.
Is an extended ACL a firewall?
It is a stateless packet filter — one component of what a firewall does. It has no connection tracking, no deep inspection, and no application awareness. For a trust boundary, use a stateful firewall.
