# Standard access-list example on Cisco Router **URL:** \ **Category:** Lessons Discussion\ **Created:** [December 22, 2016, 12:33am UTC](https://forum.networklessons.com/t/standard-access-list-example-on-cisco-router/889 "2016-12-22T00:33:02Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![ReneMolenaar](https://cdn-forum.networklessons.com/user_avatar/forum.networklessons.com/renemolenaar/32/488_2.png) [@ReneMolenaar](https://forum.networklessons.com/u/ReneMolenaar)\ **Post date:** [December 22, 2016, 12:33am UTC](https://forum.networklessons.com/t/standard-access-list-example-on-cisco-router/889/1 "2016-12-22T00:33:02Z")
This topic is to discuss the following lesson: [https://networklessons.com/cisco/ccie-enterprise-infrastructurestandard-access-list-example-on-cisco-router/](https://networklessons.com/cisco/ccie-enterprise-infrastructurestandard-access-list-example-on-cisco-router/) ---
**Author:** ![system](https://cdn-forum.networklessons.com/uploads/default/original/1X/1d2ef66728c7fbac8377748594345a3f474fce5f.png) [@system](https://forum.networklessons.com/u/system)\ **Post date:** [August 9, 2013, 2:14pm UTC](https://forum.networklessons.com/t/standard-access-list-example-on-cisco-router/889/2 "2013-08-09T14:14:11Z")
Good work. I have a question. I am using Packet Tracer 6.0.1. I have a network with 2 routers, and 2 PC’s, one on each router. They are on three different networks. 15.x.x.x, 17.x.x.x, and 20.x.x.x. PC1 is on the 15.x.x.x network, and PC2 is on the 17.x.x.x network. They can ping each other before I put in the access-list. (I’m using RIP.) Then I put in the access list on Router 2 ``` access-list 5 deny 15.0.0.0 0.255.255.255 access-list 5 permit any interface FastEthernet0/1 ip access-group 5 in ``` When I ping PC2 from PC1 I get "Reply from 20.1.1.2: Destination host unreachable. " That’s good. Now when I ping PC1 from PC2 I get “request time out.” When I ping PC1 from Router 2 I get no reply. "Success rate is 0 percent (0/5) So my question is why can’t I ping to PC1? Am I missing a command? ---
**Author:** ![ReneMolenaar](https://cdn-forum.networklessons.com/user_avatar/forum.networklessons.com/renemolenaar/32/488_2.png) [@ReneMolenaar](https://forum.networklessons.com/u/ReneMolenaar)\ **Post date:** [August 9, 2013, 2:22pm UTC](https://forum.networklessons.com/t/standard-access-list-example-on-cisco-router/889/3 "2013-08-09T14:22:10Z")
Hello George, The problem is that your ping will make it from pc2 to pc1 will make it, but the return traffic is dropped by your deny entry. Rene ---
**Author:** ![system](https://cdn-forum.networklessons.com/uploads/default/original/1X/1d2ef66728c7fbac8377748594345a3f474fce5f.png) [@system](https://forum.networklessons.com/u/system)\ **Post date:** [September 5, 2013, 5:48pm UTC](https://forum.networklessons.com/t/standard-access-list-example-on-cisco-router/889/4 "2013-09-05T17:48:50Z")
Hi Rene, I am a nornmally a windows network admin, and have been appointed to put security on our routers and swiches. I know this is a stupid question but when doing access-lists permit, Do I just put the serial address or the eithernet or both? We are running point to point and the router I am working on is remote, so I was going to put the serial address from the our core router to the remote. I only need the remote side to see our core router so would the command be access-lists 1 permit? ---
**Author:** ![ReneMolenaar](https://cdn-forum.networklessons.com/user_avatar/forum.networklessons.com/renemolenaar/32/488_2.png) [@ReneMolenaar](https://forum.networklessons.com/u/ReneMolenaar)\ **Post date:** [September 7, 2013, 3:44pm UTC](https://forum.networklessons.com/t/standard-access-list-example-on-cisco-router/889/5 "2013-09-07T15:44:35Z")
Hi Don, With the standard access-list you can only create permit or deny statements that match source addresses. If you want a more precise statement you’ll need an extended access-list because it can match on source and destination addresses. Rene ---
**Author:** ![mahmoodadil1](https://cdn-forum.networklessons.com/letter_avatar_proxy/v4/letter/m/5fc32e/32.png) [@mahmoodadil1](https://forum.networklessons.com/u/mahmoodadil1)\ **Post date:** [June 14, 2015, 1:22am UTC](https://forum.networklessons.com/t/standard-access-list-example-on-cisco-router/889/6 "2015-06-14T01:22:24Z")
Rene, You mentioned “ill show you how to modify the access-list without deleting the whole thing” but I didnt find it in this lesson. Can you please explain ? ---
**Author:** ![ReneMolenaar](https://cdn-forum.networklessons.com/user_avatar/forum.networklessons.com/renemolenaar/32/488_2.png) [@ReneMolenaar](https://forum.networklessons.com/u/ReneMolenaar)\ **Post date:** [June 15, 2015, 11:46am UTC](https://forum.networklessons.com/t/standard-access-list-example-on-cisco-router/889/7 "2015-06-15T11:46:57Z")
Hi Adil, To do this you have to use the “ip access-list” command instead of the “access-list” command. Here’s an example: ``` R1#show access-lists Standard IP access list MY_ACL 10 permit 192.168.1.0, wildcard bits 0.0.0.255 20 permit 192.168.2.0, wildcard bits 0.0.0.255 30 permit 192.168.4.0, wildcard bits 0.0.0.255 ``` Let’s say I want to add an entry for 192.168.3.0 in between, I can do it like this: ``` R1(config)#ip access-list standard MY_ACL R1(config-std-nacl)#21 permit 192.168.3.0 0.0.0.255 ``` Here it is: ``` R1#show access-lists Standard IP access list MY_ACL 10 permit 192.168.1.0, wildcard bits 0.0.0.255 20 permit 192.168.2.0, wildcard bits 0.0.0.255 21 permit 192.168.3.0, wildcard bits 0.0.0.255 30 permit 192.168.4.0, wildcard bits 0.0.0.255 ``` And you can delete statements too…let’s get rid of 10 + 20: ``` R1(config)#ip access-list standard MY_ACL R1(config-std-nacl)#no 10 R1(config-std-nacl)#no 20 ``` Now it looks like this: ``` R1#show access-lists Standard IP access list MY_ACL 21 permit 192.168.3.0, wildcard bits 0.0.0.255 30 permit 192.168.4.0, wildcard bits 0.0.0.255 ``` Hope this helps! Rene ---
**Author:** ![takhar81](https://cdn-forum.networklessons.com/letter_avatar_proxy/v4/letter/t/a183cd/32.png) [@takhar81](https://forum.networklessons.com/u/takhar81)\ **Post date:** [October 16, 2015, 12:25am UTC](https://forum.networklessons.com/t/standard-access-list-example-on-cisco-router/889/8 "2015-10-16T00:25:39Z")
can you explain how the number that is shown in match is calculated. like the first ping you did, it shows 27 matches, how is this caclulated, did it ping it 27 times etc? ---
**Author:** ![ReneMolenaar](https://cdn-forum.networklessons.com/user_avatar/forum.networklessons.com/renemolenaar/32/488_2.png) [@ReneMolenaar](https://forum.networklessons.com/u/ReneMolenaar)\ **Post date:** [October 16, 2015, 2:49pm UTC](https://forum.networklessons.com/t/standard-access-list-example-on-cisco-router/889/9 "2015-10-16T14:49:02Z")
Hi Deep, Each match that you see is a single packet that has matched, that’s it. If you see 27 matches then it means that 27 packets have matched this statement. Rene ---
**Author:** ![jonathan.olivier](https://cdn-forum.networklessons.com/letter_avatar_proxy/v4/letter/j/bc8723/32.png) [@jonathan.olivier](https://forum.networklessons.com/u/jonathan.olivier)\ **Post date:** [December 28, 2015, 8:14pm UTC](https://forum.networklessons.com/t/standard-access-list-example-on-cisco-router/889/10 "2015-12-28T20:14:24Z")
Hi Rene, Need your help once again… How can an ACL with a wild card mask of 0.0.254.254 catch odd networks and even hosts? e.g. Networks: 20.10.1.0-20.10.10.0 with 6 host in each network. The ACL will catch: 20.10.1.0(Net)/20.10.1.2,.4,.6 (Host) - 20.10.3.0(Net)/20.10.3.2,.4,.6(Host); so on so fourth… I know 254= 0000 0001, but I don’t understand how it catches only the even hosts? Thanks! Jon ---
**Author:** ![ReneMolenaar](https://cdn-forum.networklessons.com/user_avatar/forum.networklessons.com/renemolenaar/32/488_2.png) [@ReneMolenaar](https://forum.networklessons.com/u/ReneMolenaar)\ **Post date:** [December 28, 2015, 10:16pm UTC](https://forum.networklessons.com/t/standard-access-list-example-on-cisco-router/889/11 "2015-12-28T22:16:45Z")
Hi Jon, You didn’t specify the network address that you used with the wildcard. Let’s assume it’s 20.10.0.0 0.0.254.254. Let’s look at some examples… ```auto 20.10.1.0 = 00010100 000001010 00000001 00000000 20.10.1.1 = 00010100 000001010 00000001 00000001 20.10.1.2 = 00010100 000001010 00000001 00000010 20.10.1.3 = 00010100 000001010 00000001 00000011 20.10.1.4 = 00010100 000001010 00000001 00000100 20.10.2.0 = 00010100 000001010 00000010 00000000 20.10.3.0 = 00010100 000001010 00000011 00000000 20.10.4.0 = 00010100 000001010 00000100 00000000 20.10.4.1 = 00010100 000001010 00000100 00000001 20.10.4.2 = 00010100 000001010 00000100 00000010 ``` And our network and wildcard: ```auto 20.10.0.0 = 00010100 000001010 00000000 00000000 0.0.254.254 = 00000000 00000000 11111110 111111110 ``` The first two octets have to match so we are only looking at the 20.10.x.x range. Let’s forget about those two octets. ```auto 1.0 = 00000001 00000000 1.1 = 00000001 00000001 1.2 = 00000001 00000010 1.3 = 00000001 00000011 1.4 = 00000001 00000100 2.0 = 00000010 00000000 3.0 = 00000011 00000000 4.0 = 00000100 00000000 4.1 = 00000100 00000001 4.2 = 00000100 00000010 NW = 00000000 000000000 WC = 11111110 111111110 ``` With this network/wildcard combination, the 24th and 32th bit have to be a 0. We don’t care about the other bits, Only 20.10.2.0, 20.10.4.0 and 20.10.4.2 will match this. It matches only the EVEN networks with EVEN host addresses. If you want the odd networks, use a “deny” in your access-list instead of a “permit”. If you want to get funky you could use another network address in combination with this wildcard. Let’s say we pick 20.10.0.1: ```auto 20.10.0.1 = 00010100 000001010 00000000 00000001 0.0.254.254 = 00000000 00000000 11111110 111111110 ``` Let’s look at the last two octects: ```auto 1.0 = 00000001 00000000 1.1 = 00000001 00000001 1.2 = 00000001 00000010 1.3 = 00000001 00000011 1.4 = 00000001 00000100 2.0 = 00000010 00000000 3.0 = 00000011 00000000 4.0 = 00000100 00000000 4.1 = 00000100 00000001 4.2 = 00000100 00000010 NW = 00000000 000000001 WC = 11111110 111111110 ``` Now we are saying that the 24th bit has to be a 0 and the 32th bit has to be a 1. In my example that would only be 20.10.4.1. Another match would be 20.10.2.1 or 20.10.4.1. Now you have EVEN networks with ODD host addresses. Hope this helps, it can be mind boggling. If you are unsure, write down everything in binary and then check for the matching bits. You can verify your work with two routers, some loopback interfaces and a distribute-list for RIP/EIGRP. If you want some more explanations, take a look here: > **[How to create Complex Wildcard Masks](https://networklessons.com/cisco/ccie-routing-switching/create-complex-wildcard-masks)** > > This lesson explains how to create wildcards for even, uneven or "random" subnets. Rene ---
**Author:** ![ethel\_13mx](https://cdn-forum.networklessons.com/letter_avatar_proxy/v4/letter/e/ce73a5/32.png) [@ethel\_13mx](https://forum.networklessons.com/u/ethel_13mx)\ **Post date:** [April 14, 2016, 6:36pm UTC](https://forum.networklessons.com/t/standard-access-list-example-on-cisco-router/889/12 "2016-04-14T18:36:47Z")
In one on your post above, I finally understood the difference between ip access-list and only access-list command. Thanks you so much. ---
**Author:** ![ananth.gmk](https://cdn-forum.networklessons.com/letter_avatar_proxy/v4/letter/a/6a8cbe/32.png) [@ananth.gmk](https://forum.networklessons.com/u/ananth.gmk)\ **Post date:** [August 11, 2016, 3:42pm UTC](https://forum.networklessons.com/t/standard-access-list-example-on-cisco-router/889/13 "2016-08-11T15:42:21Z")
Hi rene, I have a query. If I give a ping without the source command , why it is not taking the loop back interface as source. Will it always take the physical interface by default? ---
**Author:** ![dragonsky2](https://cdn-forum.networklessons.com/letter_avatar_proxy/v4/letter/d/ce73a5/32.png) [@dragonsky2](https://forum.networklessons.com/u/dragonsky2)\ **Post date:** [August 18, 2016, 5:20pm UTC](https://forum.networklessons.com/t/standard-access-list-example-on-cisco-router/889/14 "2016-08-18T17:20:43Z")
Hello Rene/Andrew/Lazaros, Could you please tell me if I could apply an access-list inbound and an access-list outbound for the same interface. Ex: ``` R(config)#access-list 1 permit 1.1.1.0 0.0.0.255 R(config)#access-list 1 deny 2.2.2.0 0.0.0.255 R(config)#access-list 1 permit any R(config-if)#ip access-group 1 in R(config-if)#ip access-group 1 out ``` ---
**Author:** ![andrew](https://cdn-forum.networklessons.com/user_avatar/forum.networklessons.com/andrew/32/645_2.png) [@andrew](https://forum.networklessons.com/u/andrew)\ **Post date:** [August 18, 2016, 10:24pm UTC](https://forum.networklessons.com/t/standard-access-list-example-on-cisco-router/889/15 "2016-08-18T22:24:53Z")
Ananth, By default, the interface that is “closest” to the destination is the one chosen. This means, that the ip address of the interface that would be used (as dictated by CEF or the routing table) is the IP selected as the source. ---
**Author:** ![lagapidis](https://cdn-forum.networklessons.com/user_avatar/forum.networklessons.com/lagapidis/32/4949_2.png) [@lagapidis](https://forum.networklessons.com/u/lagapidis)\ **Post date:** [August 22, 2016, 8:09pm UTC](https://forum.networklessons.com/t/standard-access-list-example-on-cisco-router/889/16 "2016-08-22T20:09:10Z")
Hello Srikanth. Yes, it is possible to apply two access lists to the same interface, as long as one is inbound and the other is outbound. Actually, if you take IPv6 into account you can have up to four access lists on an interface, one per direction per protocol. I hope this has been helpful! Laz ---
**Author:** ![aravindchp](https://cdn-forum.networklessons.com/letter_avatar_proxy/v4/letter/a/74df32/32.png) [@aravindchp](https://forum.networklessons.com/u/aravindchp)\ **Post date:** [November 16, 2016, 5:37pm UTC](https://forum.networklessons.com/t/standard-access-list-example-on-cisco-router/889/17 "2016-11-16T17:37:42Z")
Hi Rene, I have a query. In the below access-list 2, why pings from R1 to IP 2.2.2.2 are failing? As per statement, it should only deny traffic from 192.168.12.0, right? ```auto R2#sh ip access-list 2 (deny traffic from n/w 192.168.12.0; permit all other n/w's) Standard IP access list 2 10 deny 192.168.12.0, wildcard bits 0.0.0.255 (90 matches) 20 permit any (30 matches) ``` ```auto R1#pi 2.2.2.2 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 2.2.2.2, timeout is 2 seconds: UUUUU Success rate is 0 percent (0/5) ``` ```auto R2#sh run int fa0/0 Building configuration... Current configuration : 119 bytes ! interface FastEthernet0/0 ip address 192.168.12.2 255.255.255.0 ip access-group 2 in duplex auto speed auto end ``` Please clarify. Thanks Aravind ---
**Author:** ![ReneMolenaar](https://cdn-forum.networklessons.com/user_avatar/forum.networklessons.com/renemolenaar/32/488_2.png) [@ReneMolenaar](https://forum.networklessons.com/u/ReneMolenaar)\ **Post date:** [November 23, 2016, 12:12pm UTC](https://forum.networklessons.com/t/standard-access-list-example-on-cisco-router/889/18 "2016-11-23T12:12:02Z")
Hi Aravind, In your deny statement, you are denying traffic from the entire 192.168.12.0/24 subnet. R1 is probably using 192.168.12.1 as its source address. Rene ---
**Author:** ![hussien.samer](https://cdn-forum.networklessons.com/user_avatar/forum.networklessons.com/hussien.samer/32/2096_2.png) [@hussien.samer](https://forum.networklessons.com/u/hussien.samer)\ **Post date:** [August 2, 2017, 2:41pm UTC](https://forum.networklessons.com/t/standard-access-list-example-on-cisco-router/889/19 "2017-08-02T14:41:19Z")
Hi Rene, How can I filter local generated packet in the router ? ---
**Author:** ![lagapidis](https://cdn-forum.networklessons.com/user_avatar/forum.networklessons.com/lagapidis/32/4949_2.png) [@lagapidis](https://forum.networklessons.com/u/lagapidis)\ **Post date:** [August 3, 2017, 9:58am UTC](https://forum.networklessons.com/t/standard-access-list-example-on-cisco-router/889/20 "2017-08-03T09:58:22Z")
Hello Hussein. Locally generated traffic can be filtered only using [Control Plane Policing (CoPP)](https://networklessons.com/system-management/copp-control-plane-policing). I hope this has been helpful! Laz [Next page](https://forum.networklessons.com/t/standard-access-list-example-on-cisco-router/889.md?page=2)