What Is an Access Control List and What Does It Show?
An Access Control List (ACL) is a fundamental component of network security that defines exactly which traffic is allowed or denied in a network. Acting as a firewall on routers, switches, and dedicated security appliances, ACLs examine packets against a sequence of rules and take action based on the first matching rule. Understanding ACLs is essential for anyone responsible for network security, from entry-level IT administrators to senior network architects.
What an ACL Shows
An ACL shows a set of ordered rules or entries, each specifying a permit or deny action along with matching criteria. For standard ACLs, the criteria is limited to the source IP address. Extended ACLs show much more detail including source IP, destination IP, protocol type (TCP, UDP, ICMP, etc.), source port, destination port, and optional parameters like established connections or ICMP message types. Each rule is evaluated in sequence, and the first match determines the action taken.
When you view an ACL on a Cisco router with the show access-list command, you see each entry with its sequence number, permit/deny action, and match criteria. The ACL also shows a hit count for each entry, revealing how many packets have matched that rule. This hit count is invaluable for troubleshooting—it tells you whether your ACL is actually filtering the traffic you intended.
Types of ACLs in Networking
There are two primary types of ACLs on Cisco and most network devices. Standard ACLs filter traffic based only on the source IP address. They are numbered 1-99 or 1300-1999 and are typically placed close to the destination network. Extended ACLs filter based on source IP, destination IP, protocol, and port numbers. They are numbered 100-199 or 2000-2699 and are placed as close to the source as possible for efficient traffic filtering.
Named ACLs are another option that uses descriptive names instead of numbers, making configurations easier to read and manage. There are also reflexive ACLs that dynamically allow return traffic from established sessions, and time-based ACLs that activate only during specified time ranges. Modern networks increasingly use VLAN ACLs (VACLs) and Port ACLs (PACLs) for finer-grained control at Layer 2 and Layer 3 boundaries.
Categories of Access Control
Access control in security is organized into several categories. Preventive controls like ACLs actively block unauthorized traffic. Detective controls monitor and log access attempts for analysis. Corrective controls remedy breaches after detection. Deterrent controls discourage malicious behavior. Recovery controls restore systems after an incident. Compensating controls provide alternative protection when primary controls are not available. Directive controls are policies and procedures that guide behavior.
From an access control model perspective, the three main types are Discretionary Access Control (DAC), where resource owners set permissions; Mandatory Access Control (MAC), where security labels determine access; and Role-Based Access Control (RBAC), where permissions are tied to job functions. Network ACLs are most commonly used to implement RBAC by defining which roles—such as servers, workstations, or management interfaces—can communicate with each other.
ACL Authentication and Multi-Factor Security
Access control works hand in hand with authentication. Type 1 authentication (something you know) includes passwords and PINs. Type 2 (something you have) includes smart cards, tokens, and mobile devices. Type 3 (something you are) includes biometrics like fingerprints and facial recognition. Multi-factor authentication (MFA) combines two or more of these types for stronger security. While ACLs operate at the network layer filtering traffic, authentication verifies identity at the user layer.
In practice, a secure network uses both ACLs and authentication together. An ACL might restrict SSH access to the management subnet (Layer 3), while Type 2 authentication (SSH key) and Type 1 authentication (password) secure the actual login. This layered approach, known as defense in depth, ensures that even if one security mechanism fails, others remain in place to protect the network.
The ACL generator tool helps you quickly create rules for multiple platforms from a single CIDR range. Whether you need Cisco IOS access lists, iptables rules, AWS Security Groups, Azure NSG rules, or Terraform configurations, the generator produces production-ready ACL entries. This saves time, reduces syntax errors, and ensures consistent security policies across your entire network infrastructure.