This guide is for learning. Run these commands only on your own lab or servers.

An access control list is an ordered list of permit and deny rules. The router reads it from the top and stops at the first match. Everything not permitted ends in an invisible deny.

Standard ACL (source only)

access-list 10 permit 192.168.10.0 0.0.0.255
interface g0/1
 ip access-group 10 out

Extended ACL (protocol and ports)

ip access-list extended WEB-ONLY
 permit tcp 192.168.10.0 0.0.0.255 any eq 80
 permit tcp 192.168.10.0 0.0.0.255 any eq 443
 deny ip any any log
interface g0/0
 ip access-group WEB-ONLY in

Verify

show access-lists
show ip interface g0/0

Place extended ACLs close to the source and standard ACLs close to the destination.

Want the commands on one page? Cisco Networking Guide · $14.99View on Gumroad