← lab guides · 2026-07-28 · 60m

ACL Basics: Standard vs Extended

Block OT vlan from LAB, allow MGMT everywhere. Placement matters.

topic: security · tool: cisco-ios · difficulty: beginner

TOPOLOGYFig. — lab diagram

[ LAB TOPOLOGY — add topology.svg to this bundle ]
  [ PC1 ]──[ SW1: vlan10 ]──[ R1 ]──[ FW ]── Internet
              └─ vlan99 MGMT  vlan20 OT (PLC/HMI)

On this page

Objective

You block OT (192.168.20.0/24) from reaching LAB (192.168.10.0/24). You allow MGMT (192.168.99.0/24) to reach both. You place a standard ACL near the destination and an extended ACL near the source.

Steps

Build extended ACL 100 on R1 for ingress.
Apply ip access-group 100 in on the OT-facing subinterface.
Test with ping and traceroute. Check show access-lists and show ip interface.

Gotcha

You hit an implicit deny at the end of every ACL. Add a permit for your management host or you lock yourself out. Keep a console open while you test.

Takeaways

ACLs match top down. First match wins.
Check direction. Inbound is not the same as outbound.
The log keyword floods the console. Turn it on when you need it.

← Back to lab guides