Cisco ACL Cheat Sheet
Standard vs. extended, wildcard masks, implicit deny, the in-vs-out trap, and the "read it like a router" mental model — everything you need to read or write any CCNA®-level ACL in under a minute.
Updated 2026-05-25 · ~7 min read · Free
The four rules that solve 80% of ACL bugs
First match wins.
Router reads top-to-bottom. The moment a line matches, it permits or denies, and stops.
Implicit deny ip any any at the end.
You never type it. The router adds it. If nothing matches, the packet is dropped silently.
Wildcard = inverse of subnet mask.
A 0 bit means "must match." A 1 bit means "don't care."
Extended → close to source. Standard → close to destination.
Otherwise you waste bandwidth carrying packets you'll drop, or block traffic too late.
Standard vs Extended
| Aspect | Standard ACL | Extended ACL |
|---|---|---|
| Filters on | Source IP only | Source + destination + protocol + port |
| Numbered range | 1–99 or 1300–1999 | 100–199 or 2000–2699 |
| Apply where | Close to destination | Close to source |
| When to use | Block an entire subnet from reaching another subnet | Block a specific port or protocol between hosts |
| Modern preference | Named is preferred over numbered | Named is preferred — much easier to edit |
Standard — example
! Block 10.1.1.0/24 from reaching anything beyond R1
ip access-list standard BLOCK-FINANCE
deny 10.1.1.0 0.0.0.255
permit any
!
interface GigabitEthernet0/1
ip access-group BLOCK-FINANCE outExtended — example
! Permit only HTTP + HTTPS from 10.0.0.0/24 to anywhere
ip access-list extended WEB-ONLY
permit tcp 10.0.0.0 0.0.0.255 any eq 80
permit tcp 10.0.0.0 0.0.0.255 any eq 443
deny ip any any log
!
interface GigabitEthernet0/0
ip access-group WEB-ONLY inWildcard masks — the 30-second version
Subnet masks say "these bits are network."
Wildcard masks say "these bits I care about — the rest I don't."
A 0 in the wildcard means "must match exactly." A
1 means "don't care, anything works."
Fastest conversion: subtract the subnet mask from 255.255.255.255.
| CIDR | Subnet mask | Wildcard mask | Hosts matched |
|---|---|---|---|
| /8 | 255.0.0.0 | 0.255.255.255 | 16,777,214 |
| /16 | 255.255.0.0 | 0.0.255.255 | 65,534 |
| /24 | 255.255.255.0 | 0.0.0.255 | 254 |
| /25 | 255.255.255.128 | 0.0.0.127 | 126 |
| /26 | 255.255.255.192 | 0.0.0.63 | 62 |
| /27 | 255.255.255.224 | 0.0.0.31 | 30 |
| /28 | 255.255.255.240 | 0.0.0.15 | 14 |
| /29 | 255.255.255.248 | 0.0.0.7 | 6 |
| /30 | 255.255.255.252 | 0.0.0.3 | 2 |
| /32 | 255.255.255.255 | 0.0.0.0 | 1 (exact host) |
Three special wildcards everyone should memorize
- host 192.168.1.5 =
192.168.1.5 0.0.0.0· exact single host - any =
0.0.0.0 255.255.255.255· match anything - 0.0.0.255 = match a /24 subnet. Memorize this one — it covers ~70% of CCNA ACL questions.
How a router reads an ACL
Top to bottom. First match wins. No more processing. That's it.
access-list 100 permit tcp any any eq 80 ← line 10
access-list 100 permit tcp any any eq 443 ← line 20
access-list 100 deny ip any any ← line 30 (explicit deny)
← implicit deny lives here, invisiblyA packet to port 80 → matches line 10 → permit, done. No line 20 lookup, no line 30. A packet to port 22 → no match on 10, no match on 20, matches 30 → deny, done. The third line is technically redundant (the implicit deny would catch it anyway), but writing it explicitly makes intent obvious six months later.
The "read it like a router" trick
Train yourself to read any ACL in three passes:
- What's explicitly permitted? Skim the
permitlines. That's the only traffic this ACL will allow through. - What's explicitly denied? The
denylines name traffic important enough to call out (often withlog). - Everything else is implicitly denied. If a packet doesn't match anything above, it's silently dropped.
Shortcut for understanding what an ACL actually does in production: read it bottom-up. The last line is usually the most general. Work upwards finding the more specific exceptions. That's the policy intent in human terms.
In vs out — the single biggest trap
Filter packets arriving on this interface — before the routing decision is made.
Filter packets leaving this interface — after the routing decision, on the way out.
Half the real-world "ACL doesn't work" tickets are direction bugs, not rule bugs. If
the rule looks right but traffic still fails, swap in for
out (or vice versa) and re-test before changing the rules.
Common mistakes (in order of frequency)
- Forgetting the implicit deny. Your three permits don't help if every other packet is silently dropped. Test what you didn't intend to block.
- Wrong direction (in vs out). See the trap above. Always re-verify after editing.
- Wildcard mask backwards. Using
255.255.255.0instead of0.0.0.255— a frequent CCNA exam trap. - Too-general line above a too-specific line. First match wins. Put more-specific rules earlier.
- Applied to the wrong interface. Extended ACL belongs close to source. Standard close to destination. Reversed = wasted bandwidth or unintended filtering.
- Numbered ACL with no way to edit a single line. Use named ACLs in production — they support sequence numbers and line-level edits.
- Blocking return traffic. If you permit outbound TCP but block inbound TCP, return packets die. Use
establishedor move to reflexive/zone-based for stateful filtering.
The one-page summary
Save / screenshot / print this block — it's everything above, condensed.
Reading order
- Top to bottom, first match wins
- Then the invisible deny ip any any
- permit lines = the only traffic allowed
- deny lines = explicit calls-out (often logged)
Wildcard masks
- /24 → 0.0.0.255
- /25 → 0.0.0.127
- /30 → 0.0.0.3
- host = 0.0.0.0 · any = 255.255.255.255
Where to apply
- Standard → close to destination, out direction
- Extended → close to source, in direction
Top 3 traps
- Forgot implicit deny
- Wrong direction (in vs out)
- Wildcard mask written backwards
Where to go next
ACLs: The Mental Model That Makes Them Click
Long-form tutorial on the same topic, with a step-by-step lab to run tonight.
PracticePacket Tracer Labs
Free downloadable topologies — including an Extended ACL walk-through.
1:1 helpStuck on a real-world ACL?
Book a free first session. Bring your config — we'll debug it together.
More cheat sheets in your inbox
VLANs, OSPF, subnetting, DHCP snooping — one per fortnight. One-click unsubscribe.
We respect your inbox. One email per week, max. Unsubscribe any time.