| 3.1 |  | Access Control Lists |
| 3.1.1 |  | ACL basics |

| This module explains how IP ACLs can filter and secure network traffic. It also contains brief descriptions of the IP ACL types, features of each, and an example of use in a network. ACLs may also be used for purposes other than filtering IP traffic, such as defining traffic to NAT, encryption, filtering non-IP protocols such as AppleTalk or IPX, or providing Quality of Service (QoS).

ACLs filter network traffic by controlling whether routed or switched packets are forwarded or blocked at the router or switch interface . The router or switch examines each packet to determine whether to forward or drop the packet, based on the criteria specified within the ACL. ACL criteria can be the source address of the traffic, the destination address of the traffic, or the upper-layer protocol. An ACL is constructed in two steps:

1. Create an ACL
2. Apply the ACL

The IP ACL is a sequential collection of permit and deny conditions that apply to an IP address. The router or switch tests addresses against the conditions in the ACL one at a time. The first match determines whether the Cisco IOS software accepts or rejects the address. Because the Cisco IOS software stops testing conditions after the first match, it is important to order the conditions in the most efficient way. If none of the conditions match, the router rejects the address. This is due to an implicit deny any clause, which is fixed at the end of the list of conditions.

In addition to defining ACL sources and destinations, it is possible to define ports, ICMP message types, and other parameters. The router can display descriptive text on some of the well-known ports. The ? or help command can be used to display useful information . information During configuration, the router also converts numeric values to more user-friendly values. The following is an example wherein typing the ICMP message type number causes the router to convert the number to a name .