Standard & Extended ACL Quick Reference

Standard ACLs match source IP only — coarse, typically used for management-plane restriction (VTY access-class), applied as close to the destination as practical since they can't distinguish traffic by anything but source.

Extended ACLs match source, destination, protocol, and port — precise enough for data-plane filtering, generally applied as close to the source as practical to stop unwanted traffic early.

A wildcard mask is inverted logic from a subnet mask: 0 bits must match exactly, 1 bits are 'don't care.' 0.0.0.255 matches an entire /24; 0.0.0.0 matches a single host exactly (equivalent to 'host <ip>').

ACL entries are evaluated top-to-bottom with first-match-wins logic — evaluation stops at the first match, full stop. A broad permit placed before a specific deny makes that deny unreachable, even though it's still present in the configuration.

Every ACL ends with an implicit deny all — an ACL with only deny entries and no explicit permit blocks everything, including traffic you meant to allow.

A perfectly written ACL not applied to any interface (or access-class) has zero effect. Always verify application, not just content: 'show ip interface <int>' shows applied ACLs on that interface; 'show run | section line vty' shows the access-class on management lines.

Check match counters ('show access-lists <name>') to confirm an entry is actually being hit by real traffic — a zero count on an expected-to-match entry usually means an ordering or addressing problem, not that the traffic simply hasn't occurred yet.