Named ACLs – Configuration, Sequence Numbers, and Management

1. What Are Named ACLs?

A Named ACL is an Access Control List identified by a descriptive text name — such as BLOCK_WEB or PERMIT_ADMIN — rather than a numeric identifier. Named ACLs were introduced in Cisco IOS 12.0 and are now the preferred approach for all ACL work on modern networks.

Named ACLs support both standard (filter on source IP only) and extended (filter on source IP, destination IP, protocol, and port) types, and add the critical ability to edit individual entries using sequence numbers — something numbered ACLs cannot do without deleting and recreating the entire list.

  Numbered ACL:          Named ACL:
  access-list 101 ...    ip access-list extended BLOCK_WEB
  access-list 101 ...     10 permit tcp any host 10.0.0.1 eq 80
                          20 deny   ip  any any
  Identified by: 101     Identified by: BLOCK_WEB
  Edit: delete & redo    Edit: change sequence 10 in place
            

Related pages: Applying ACLs | ACL Overview | Standard ACLs | Extended ACLs | Wildcard Masks | Firewalls | Standard ACL Config Lab | Extended ACL Config Lab | Troubleshooting ACL Misconfigurations

2. Named ACL vs Numbered ACL — Full Comparison

Both types enforce the same packet filtering logic but differ significantly in how they are identified, created, and maintained. For any production or exam scenario, named ACLs are the preferred choice.

3. ACL Fundamentals — Standard vs Extended

Before configuring a named ACL, understand which type to use. The type determines what fields in the packet the ACL can match against, and where on the network it should be applied.

See: Standard ACLs | Extended ACLs | Wildcard Masks | Applying ACLs

4. The Implicit Deny — Critical Behaviour

Every ACL — named or numbered, standard or extended — ends with an invisible implicit deny any statement. This rule is not shown in show access-lists output but is always present and always evaluated last. Any packet that does not match any explicit rule in the ACL is silently dropped.

  ip access-list extended BLOCK_WEB
   10 permit tcp 192.168.1.0 0.0.0.255 host 10.0.0.1 eq 80
   20 permit ip  192.168.1.0 0.0.0.255 any
   [implicit: deny ip any any]    ← always here, never shown

  A packet from 10.0.0.50 → 10.0.0.1:80 arrives:
  → Does NOT match seq 10 (wrong source subnet)
  → Does NOT match seq 20 (wrong source subnet)
  → Hits implicit deny → DROPPED ✗

  A packet from 192.168.1.10 → 8.8.8.8:443 arrives:
  → Does NOT match seq 10 (wrong port and destination)
  → MATCHES seq 20 (source is in 192.168.1.0/24, any dest) → PERMITTED ✓
            

Common mistake: Creating an ACL that only contains deny statements without at least one permit — the implicit deny means absolutely all traffic is blocked. Always include an explicit permit ip any any at the end if you only want to deny specific traffic and allow everything else.

5. Wildcard Masks — Quick Reference

ACL permit and deny statements use wildcard masks to match ranges of IP addresses. A wildcard mask is the inverse of a subnet mask: 0 bits must match, 1 bits are ignored ("wildcarded"). Two special shortcuts are also available.

See: Wildcard Masks Explained

6. Creating Named ACLs — Full Syntax

Named ACLs are configured in a dedicated ACL configuration submode. You enter the submode with the ip access-list {standard|extended} <name> command, then add entries one per line. Sequence numbers are optional but strongly recommended.

Standard Named ACL

  Router(config)# ip access-list standard PERMIT_SALES
  Router(config-std-nacl)# 10 permit 192.168.10.0 0.0.0.255
  Router(config-std-nacl)# 20 permit host 192.168.20.5
  Router(config-std-nacl)# 30 deny   any
  Router(config-std-nacl)# exit

  ! Effect: Permit the 192.168.10.0/24 subnet and host 192.168.20.5;
  !         deny all other sources.
  ! (The explicit "deny any" at seq 30 documents the implicit deny — good practice)
            

Extended Named ACL

  Router(config)# ip access-list extended BLOCK_WEB
  Router(config-ext-nacl)# 10 deny   tcp any host 10.0.0.1 eq 80
  Router(config-ext-nacl)# 20 deny   tcp any host 10.0.0.1 eq 443
  Router(config-ext-nacl)# 30 permit ip  any any
  Router(config-ext-nacl)# exit

  ! Effect: Block HTTP (80) and HTTPS (443) to server 10.0.0.1 from any source;
  !         permit all other traffic.
            

Extended ACL Entry Syntax — Field by Field

  [seq#] {permit|deny} {protocol} {src-addr} {src-wildcard} {dst-addr} {dst-wildcard} [eq {port}] [log]

  Example:
  10     deny     tcp      192.168.1.0 0.0.0.255  host 10.0.0.5  eq 23  log

  │      │         │        │                      │               │      │
  seq    action  protocol  source network          dest host      Telnet  log matches
  10     deny                                                      (23)
            

7. Sequence Numbers — Insert, Delete, and Reorder

Sequence numbers are the defining advantage of named ACLs over numbered ACLs. They give every ACE a position in the list that can be explicitly controlled, allowing surgical editing without disrupting the rest of the policy.

Auto-assignment

If you add entries without specifying a sequence number, IOS auto-assigns them starting at 10 and incrementing by 10. This leaves room for insertion between existing entries later.

  Router(config)# ip access-list extended BLOCK_WEB
  Router(config-ext-nacl)# permit tcp any host 10.0.0.1 eq 80   ! gets seq 10
  Router(config-ext-nacl)# deny ip any any                       ! gets seq 20
            

Insert a new entry between existing ones

  ! Insert a rule between seq 10 and seq 20:
  Router(config)# ip access-list extended BLOCK_WEB
  Router(config-ext-nacl)# 15 permit icmp any host 10.0.0.1

  ! Result:
  !  10 permit tcp any host 10.0.0.1 eq 80
  !  15 permit icmp any host 10.0.0.1      ← newly inserted
  !  20 deny ip any any
            

Delete a specific entry by sequence number

  Router(config)# ip access-list extended BLOCK_WEB
  Router(config-ext-nacl)# no 15

  ! Seq 15 is removed; sequences 10 and 20 are unaffected.
            

Resequence an entire ACL

After many insertions and deletions, sequence numbers can become fragmented (e.g., 10, 11, 12, 15, 27…). Resequencing renumbers all entries cleanly without changing the order or logic:

  Router(config)# ip access-list resequence BLOCK_WEB 10 10
  ! Starts at 10, increments by 10:
  ! Old:  10, 11, 12, 15, 27  →  New: 10, 20, 30, 40, 50
            

Exam tip: In numbered ACLs, the only way to remove a single entry is to delete the entire ACL with no access-list <number> and re-enter everything. Named ACLs allow removal of a single entry with no <sequence-number> inside ACL submode — one of the most frequently tested distinctions.

8. Applying Named ACLs

A named ACL does nothing until it is applied somewhere. Cisco IOS supports several application points.

On a Router Interface (most common)

  Router(config)# interface GigabitEthernet0/1
  Router(config-if)# ip access-group BLOCK_WEB in

  ! "in"  = filters packets arriving ON this interface (inbound)
  ! "out" = filters packets leaving FROM this interface (outbound)
  ! One ACL per interface per direction (in and out can both be applied)
            

Direction decision: Apply in to filter traffic before it is processed by the router (most efficient — drops unwanted packets immediately). Apply out to filter traffic just before it exits the router toward a destination network.

  Inbound ACL:                      Outbound ACL:
  Packet arrives →                  Packet arrives →
  ACL checks →                      Routing decision →
  Routing decision →                ACL checks →
  Forward                           Forward / Drop
            

On a Layer 3 Switch SVI

  Switch(config)# interface vlan 10
  Switch(config-if)# ip access-group PERMIT_SALES in
            

On VTY Lines (restrict management access)

  ! Only allow 192.168.100.0/24 to SSH/Telnet into the router:
  Router(config)# ip access-list standard MGMT_ACCESS
  Router(config-std-nacl)# 10 permit 192.168.100.0 0.0.0.255
  Router(config-std-nacl)# exit

  Router(config)# line vty 0 4
  Router(config-line)# access-class MGMT_ACCESS in

  ! Note: VTY lines use "access-class" not "ip access-group"
  !       and standard ACLs only (source IP restriction)
            

In Route-Maps (for PBR or NAT)

  ! Named ACL used as a match condition in a route-map:
  Router(config)# ip access-list extended VOICE_TRAFFIC
  Router(config-ext-nacl)# 10 permit udp any any range 16384 32767
  Router(config-ext-nacl)# exit

  Router(config)# route-map PBR_VOICE permit 10
  Router(config-route-map)# match ip address VOICE_TRAFFIC
  Router(config-route-map)# set ip next-hop 10.0.0.254
            

See: Applying ACLs | Router-on-a-Stick | Static NAT | Dynamic NAT | SSH Configuration | Telnet

9. Viewing and Verifying Named ACLs

After creating and applying a named ACL, always verify it is correct and taking effect. The hit counters in show access-lists are one of the most powerful diagnostic tools available — they show exactly which rules are being matched.

  Router# show access-lists BLOCK_WEB
  Extended IP access list BLOCK_WEB
      10 deny tcp any host 10.0.0.1 eq 80 (47 matches)   ← 47 packets matched
      15 permit icmp any host 10.0.0.1 (0 matches)
      20 deny ip any any (12 matches)

  Router# show access-lists
  ! (shows ALL ACLs on the device)

  Router# show running-config | section ip access-list
  ! (shows ACL definitions in the running config)

  Router# show ip interface GigabitEthernet0/1
  ! Look for: "Inbound access list is BLOCK_WEB"
  !           "Outbound access list is not set"
            

See: show running-config | show interfaces | show ip interface brief

10. Complete Configuration Example — End-to-End

A network engineer needs to implement the following policy on Router R1's GigabitEthernet0/1 (connected to the internal 192.168.1.0/24 LAN):

• Block Telnet (TCP/23) from any source to any destination.
• Block HTTP (TCP/80) from the 192.168.1.0/24 subnet to the server at 10.10.10.10.
• Permit all other traffic from 192.168.1.0/24.
• Deny everything else (implicit, but explicitly documented).

  ! ─── Step 1: Create the named extended ACL ─────────────────────
  R1(config)# ip access-list extended INTERNAL_POLICY

  R1(config-ext-nacl)# 10 deny tcp any any eq 23
  ! Block Telnet from any source to any destination

  R1(config-ext-nacl)# 20 deny tcp 192.168.1.0 0.0.0.255 host 10.10.10.10 eq 80
  ! Block HTTP from 192.168.1.0/24 to server 10.10.10.10

  R1(config-ext-nacl)# 30 permit ip 192.168.1.0 0.0.0.255 any
  ! Permit all other traffic from 192.168.1.0/24

  R1(config-ext-nacl)# 40 deny ip any any
  ! Explicit deny (documents the implicit deny)

  R1(config-ext-nacl)# exit

  ! ─── Step 2: Apply inbound on the LAN-facing interface ─────────
  R1(config)# interface GigabitEthernet0/1
  R1(config-if)# ip access-group INTERNAL_POLICY in
  R1(config-if)# exit

  ! ─── Step 3: Restrict VTY access to admin subnet only ──────────
  R1(config)# ip access-list standard MGMT_ONLY
  R1(config-std-nacl)# 10 permit 192.168.100.0 0.0.0.255
  R1(config-std-nacl)# exit

  R1(config)# line vty 0 4
  R1(config-line)# access-class MGMT_ONLY in
  R1(config-line)# exit

  ! ─── Step 4: Verify ─────────────────────────────────────────────
  R1# show access-lists INTERNAL_POLICY
  R1# show ip interface GigabitEthernet0/1
            

Placement reasoning: The ACL is applied in on GigabitEthernet0/1 (the LAN interface). Inbound means the router checks traffic as it arrives from the LAN — before routing it onward. This is the extended ACL best-practice placement: close to the source, blocking unwanted traffic before it consumes router resources.

11. Troubleshooting Named ACLs

The log keyword: Adding log to a deny entry generates a syslog message the first time a packet matches that entry in each 5-minute interval, including the source IP and hit count. This is invaluable for real-time troubleshooting without running a full packet capture. See: Syslog

  ip access-list extended BLOCK_WEB
   10 deny tcp any host 10.0.0.1 eq 80 log
   20 permit ip any any

  ! When a packet hits seq 10:
  %SEC-6-IPACCESSLOGP: list BLOCK_WEB denied tcp 192.168.1.5(49281)
                         -> 10.0.0.1(80), 1 packet
            

See: Troubleshooting ACL Misconfigurations | debug ip packet | show logging | ping | traceroute

12. Limitations and Considerations

13. Best Practices

• Use descriptive UPPERCASE names with underscores: BLOCK_TELNET_EXTERNAL, PERMIT_ADMIN_SSH, DENY_ROGUE_HOSTS.
• Always use sequence numbers — start at 10, increment by 10. Leave gaps for future insertions.
• Place the most specific rules first (lowest sequence numbers) and the most general rules last. A broad permit ip any any at the top defeats the purpose of the ACL.
• Include an explicit deny ip any any log as the last entry to document the implicit deny and generate logs when traffic hits it.
• Test in a lab or at a low-traffic time before applying to production interfaces. An ACL error can silently drop legitimate traffic.
• Always apply the ACL to the correct direction — inbound on the source-facing interface for extended ACLs; close to the destination for standard ACLs.
• Use show access-lists and hit counters to validate your policy is matching the traffic you intend.
• Document the business reason for each ACL using Cisco IOS remark entries: 10 remark Block Telnet per security policy SR-2024-01

14. Summary Reference Table

Named ACLs Quiz