2026-09-05

Demistifying Access Control Lists

Making sense of Cisco's ACLs and Pooled NAT

Trying to figure out which ACL to use can be confusing

By taking a step back it can be helpful to determine the proper configurations needed for your ACL implementation.

There's only two types of ACL but both can be named or unnamed.

Types of ACLs

ACL type	Numbers	Location	Filters
`Standard`	1-99, 1300-1999	close to destination	Source IP only
`Extended`	100-199, 2000-2699	close to source	IP, protocol, port

Naming an ACL only changes its setup, not its capabilities

Configuring the same ACL with standard and standard named


    conf t
    access-list 10 permit 10.10.10.0 0.0.0.255
    access-list 10 deny any
    
    int g0/0
      ip access-group 10 out


    conf t
    ip access-list standard BLOCK_SALES
      permit 10.10.10.0 0.0.0.255
      deny any
        
    int g0/0
      ip access-group BLOCK_SALES out

Configuring the same Extended-ACL with extended and extended named


    conf t
    access-list 110 permit tcp 10.10.10.0 0.0.0.255 host 172.16.0.5 eq 80
    access-list 110 deny ip any any

    int g0/0
      ip access-group 110 in


    conf t
    ip access-list extended BLOCK_WEB
      permit tcp 10.10.10.0 0.0.0.255 host 172.16.0.5 eq 80
      deny ip any any

    int g0/0
      ip access-group BLOCK_WEB in

How ACLs process traffic

Pooled NAT

Pooled (dynamic) NAT maps a group of inside local addresses to a pool of outside global addresses, many-to-many, rather than a single fixed pair like static NAT. An ACL defines which hosts are eligible for translation. The ACL is never applied to an interface here, it's referenced directly by the NAT command.

Step 1: Mark inside and outside interfaces


    int g0/0
      ip nat inside

    int g0/1
      ip nat outside

Step 2: Define which hosts are eligible - (standard ACL)


    conf t
    access-list 10 permit 10.10.10.0 0.0.0.255

Step 3: Define the pool of outside addresses


    ip nat pool NAT_POOL 203.0.113.1 203.0.113.10 netmask 255.255.255.0

Step 4:Tie the ACL to the pool


    ip nat inside source list 10 pool NAT_POOL

To use a named ACL steps 2 and 4 change to:


    conf t
    ip access-list standard NAT_HOSTS
      permit 10.10.10.0 0.0.0.255


    ip nat inside source list NAT_HOSTS pool NAT_POOL

Show commands

ACL

show access-lists: Display active ACLs
show access-lists 110: Details on a specific list
show ip interface g0/0: What rules are being enforced on a specific port
show running-config | include access-list: Confirm lists are being enforced

NAT

show ip nat translations: Confirm rules
show ip nat statistics: Display information on usage
show running-config | section nat: Confirm the rule is in the config