Design law: extended near the source, standard near the destination — stop unwanted traffic before it crosses the network. Named ACLs with sequence numbers for editable production lists; least privilege; no accidental permit ip any any.

Types: standard = source only; extended = proto + src/dst + ports; time-range ACLs for business-hours rules; prefix-lists/route-maps when the object is routes rather than packets.

Troubleshooting checklist

1. show ip interface — applied at all, right direction?
2. show access-lists — the match counters don’t lie. (0 matches) = rule never hit.
3. Top-down, first match wins — check ordering.
4. Wildcard masks (0.0.0.255 = /24, 0.0.0.0 = host).
5. Ports are destination ports; DNS needs UDP 53 (and TCP for big answers); ping is ICMP.
6. Implicit deny always exists — the classic “everything else works, last rule doesn’t”.

deny ip any any log      ! temporary, watch CPU

Remember the trap of asymmetric return paths: outbound fine, return blocked by an ACL on the reverse interface.