Good ACL design is about correct placement, minimal traffic impact and easy troubleshooting – and troubleshooting requires systematic analysis of matches, order and placement.

Design goals (CCNP)

• Security – restrict only what’s necessary · Scalability · Troubleshootability · Performance – avoid unnecessary CPU load

Design principles

1. Choose the right ACL type: simple filtering/management → standard; application & security control → extended (almost always in CCNP); routing policy → prefix-lists/route-maps; control-plane → extended ACL + CoPP
2. Correct placement: standard ACL near the destination; extended ACL near the source – stops unwanted traffic before it crosses the network
3. Least privilege: permit only necessary traffic, deny the rest; avoid permit ip any any
4. Named ACLs (best practice): readable, editable, sequence numbers for safe live changes:

ip access-list extended USERS_TO_SERVERS
 10 permit tcp 10.10.10.0 0.0.0.255 10.20.20.10 0.0.0.0 eq 443
 20 deny ip any any

5. Document the logic – CCNP expects you to explain why the ACL looks like this

Troubleshooting method: “traffic should be allowed but is dropped”

1. Is the ACL even active? show ip interface GigabitEthernet0/1 – in/out direction, correct interface, correct name
2. Does traffic match? show access-lists – hit counters; 0 matches = the rule is never used
3. Wrong order? ACLs process top-down, first match wins
4. Wrong wildcard mask? 0.0.0.0 = one host, 0.0.0.255 = /24 – a wrong wildcard means no match
5. Wrong port position? Extended ACL matches destination port after the destination IP: ❌ permit tcp any eq 80 host 10.10.10.10 ✔ permit tcp any host 10.10.10.10 eq 80
6. Wrong protocol? DNS = UDP 53 (not TCP), ping = ICMP, HTTP = TCP 80
7. Implicit deny always exists – deny ip any any if nothing matches (exam favourite)

Logging as a tool: deny ip any any log – use briefly; can load the CPU on busy links.

ACL with other features

• ACL + NAT: the ACL matches NAT traffic – an ACL error = NAT doesn’t work
• ACL + PBR: the ACL defines which traffic is policy-routed
• ACL + CoPP: the ACL classifies control-plane traffic – a wrong ACL makes the router lose SSH/OSPF/BGP

Typical CCNP mistakes

• ACL matches but is applied wrongly · traffic hits a different interface than expected · show run looks fine but the counters tell the truth · asymmetry – outbound OK, return path blocked

Cheat sheet

• Extended → near source · Standard → near destination · top-down · first match wins · implicit deny always · show access-lists is your best friend