Standard ACLs

Standard ACLs 
11.2.1

Standard ACLs check the source address of IP packets that are routed. The ACL will either permit or deny access for an entire protocol suite, based on the network, subnet, and host addresses. For example, packets that come in Fa0/0 are checked for their source addresses and protocols. If they are permitted, the packets are routed through the router to an output interface. If they are not permitted, they are dropped at the incoming interface.

The standard version of the access-list global configuration command is used to define a standard ACL with a number in the range of 1 to 99 (also from 1300 to 1999 in recent IOS). In Cisco IOS Software Release 12.0.1, standard ACLs began using additional numbers (1300 to 1999) to provide a maximum of 798 possible standard ACLs. These additional numbers are referred to as expanded IP ACLs. In the first ACL statement, notice that there is no wildcard mask. Since no list is shown, the default mask of 0.0.0.0 is used. The entire address must match or the router must check for a match in the next line in the ACL.

The full syntax of the standard ACL command is as follows:

Router(config)#access-listaccess-list-number deny permit remarksource [source-wildcard ] [log]

The no form of this command is used to remove a standard ACL. The remark keyword makes the access list easier to understand. Each remark is limited to 100 characters. For example, it is not immediately clear what the purpose of the following entry is:

Router(config)#access-list 1 permit 171.69.2.88

It is much easier to read a remark about the entry to understand its effect, as follows:

Router(config)#access-list 1 remark Permit only Jones workstation through access-list 1 permit 171.69.2.88

To remove a standard ACL, use the no form of the command. This is the syntax:

Router(config)#no access-listaccess-list-number

The no form of this command is used to remove a standard ACL. The syntax is as follows:

Router(config)#no access-list access-list-number

The ip access-group command links an existing standard ACL to an interface:

Router(config)#ip access-group {access-list-number | access-list-name } {in | out }

The table shows descriptions of the parameters used in this syntax.
The Lab Activities will teach students how to plan, configure, and apply standard ACLs to permit or deny traffic.
The next page will describe extended ACLs