[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"detail-sidebar-cat-0-en-105":3,"doc-seo-387858-105":59,"doc-detail-387858-en":130},{"code":4,"msg":5,"data":6},0,"success",[7,13,18,23,28,33,38,43,48,51,55],{"id":8,"doc_module":4,"doc_module_name":9,"category_name":10,"show_sort_weight":11,"slug":12},1,"Document","Story & Novel",90,"story-novel",{"id":14,"doc_module":4,"doc_module_name":9,"category_name":15,"show_sort_weight":16,"slug":17},2,"Literature",80,"literature",{"id":19,"doc_module":4,"doc_module_name":9,"category_name":20,"show_sort_weight":21,"slug":22},4,"Exam",70,"exam",{"id":24,"doc_module":4,"doc_module_name":9,"category_name":25,"show_sort_weight":26,"slug":27},5,"Comic",60,"comic",{"id":29,"doc_module":4,"doc_module_name":9,"category_name":30,"show_sort_weight":31,"slug":32},6,"Technology",50,"technology",{"id":34,"doc_module":4,"doc_module_name":9,"category_name":35,"show_sort_weight":36,"slug":37},7,"Healthcare",40,"healthcare",{"id":39,"doc_module":4,"doc_module_name":9,"category_name":40,"show_sort_weight":41,"slug":42},8,"Research & Report",30,"research-report",{"id":44,"doc_module":4,"doc_module_name":9,"category_name":45,"show_sort_weight":46,"slug":47},9,"Religion & Spirituality",20,"religion-spirituality",{"id":46,"doc_module":4,"doc_module_name":9,"category_name":49,"show_sort_weight":46,"slug":50},"World Cup","world-cup",{"id":52,"doc_module":4,"doc_module_name":9,"category_name":53,"show_sort_weight":52,"slug":54},10,"Lifestyle","lifestyle",{"id":56,"doc_module":4,"doc_module_name":9,"category_name":57,"show_sort_weight":24,"slug":58},19,"General","general",{"code":4,"msg":60,"data":61},"ok",{"site_id":62,"language":63,"slug":64,"title":65,"keywords":66,"description":67,"schema_data":68,"social_meta":123,"head_meta":125,"extra_data":127,"updated_unix":129},105,"en","fundamentals-of-cisco-asa-security-appliance-access-control-lists","Fundamentals of Cisco ASA Security Appliance Access-Control Lists","","Covers how Cisco ASA Security Appliance Access-Control Lists (ACLs) work, including the permit/deny evaluation process, sequential rule matching, and the implicit “deny any” behavior at the end of each ACL. Explains standard vs extended ACL types and the structure of ACL entries (ACEs), including named ACLs and differences from router syntax. Provides guidance on creating, editing, inserting, and removing ACEs, using the “inactive” option, and applying time ranges. Also introduces object groups to simplify ACL management and how to apply them to ACEs.",{"@graph":69,"@context":122},[70,84,105],{"@type":71,"itemListElement":72},"BreadcrumbList",[73,77,79,82],{"item":74,"name":75,"@type":76,"position":8},"https://docshare.wps.com","Home","ListItem",{"item":78,"name":9,"@type":76,"position":14},"https://docshare.wps.com/document/",{"item":80,"name":20,"@type":76,"position":81},"https://docshare.wps.com/document/exam/",3,{"item":83,"name":65,"@type":76,"position":19},"https://docshare.wps.com/document/fundamentals-of-cisco-asa-security-appliance-access-control-lists/387858/",{"url":83,"name":65,"@type":85,"image":86,"author":91,"headline":65,"publisher":94,"fileFormat":97,"inLanguage":63,"description":67,"dateModified":98,"datePublished":99,"encodingFormat":97,"isAccessibleForFree":100,"interactionStatistic":101},"DigitalDocument",{"url":87,"@type":88,"width":89,"height":90},"https://docshare.wps.com/thumbnails/fundamentals-of-cisco-asa-security-appliance-access-control-lists/387858.png","ImageObject",300,407,{"name":92,"@type":93},"Stanford","Person",{"url":74,"name":95,"@type":96},"DocShare","Organization","application/pdf","2026-11-03","2026-09-24",true,{"@type":102,"interactionType":103,"userInteractionCount":34},"InteractionCounter",{"@type":104},"ViewAction",{"@type":106,"mainEntity":107},"FAQPage",[108,114,118],{"name":109,"@type":110,"acceptedAnswer":111},"How are packets evaluated against a Cisco ASA ACL?","Question",{"text":112,"@type":113},"Packets are evaluated against ACL entries in sequential order. Once a packet matches an entry, no further evaluation occurs.","Answer",{"name":115,"@type":110,"acceptedAnswer":116},"What happens if a packet does not match any ACL entry?",{"text":117,"@type":113},"Cisco ASA ACLs include an implicit “deny any” at the end, so any packet not explicitly permitted is implicitly denied.",{"name":119,"@type":110,"acceptedAnswer":120},"What is the difference between standard and extended ACLs on ASA?",{"text":121,"@type":113},"Standard ACLs filter only on the source IP address. Extended ACLs can filter on source/destination IPs, protocol types, and TCP/UDP port numbers.","https://schema.org",{"og:url":83,"og:type":124,"og:title":65,"og:site_name":95,"og:description":67},"article",{"robots":126,"canonical":83},"index,follow",{"doc_id":128,"site_id":62},387858,1790843110,{"code":4,"msg":5,"data":131},{"doc_id":128,"user_id":132,"nickname":92,"user_avatar":133,"doc_module":4,"category_id":19,"category_name":20,"doc_title":65,"doc_description":67,"doc_content":134,"file_id":135,"file_url":136,"file_type":137,"file_size":138,"view_count":34,"is_deleted":4,"is_public":8,"is_downloadable":8,"audit_status":8,"page_count":19,"language":139,"language_code":63,"site_id":62,"html_lang":63,"table_of_contents":140,"faqs":141,"seo_title":142,"seo_description":67,"update_tm":143,"read_time":52,"preview_page_count":4},2336477552062,"https://ap-avatar.wpscdn.com/davatar_994ba38a5ba835b3df7d355c54d3ed8d","Fundamentals of Cisco ASA Security Appliance Access-Control Lists  \nPage | 1  \nBy Don R. Crawley, CCNA Security, Linux+  \nThis document is from the book “The Accidental Administrator: Cisco ASA Security Appliance”, available on [Amazon.com](Amazon.com) and based on Cisco ASA Training: 2-Day HandsOn Workshop. A companion video is [available:](available: www.youtube.com/soundtraining)[ ](available: www.youtube.com/soundtraining)[www.youtube.com/soundtraining](available: www.youtube.com/soundtraining).  \nUnderstanding Access Control Lists  \nAccess Control Lists (ACLs) are lists of permit and deny conditions applied to traffic flows and based on various criteria including protocol type source IP address, destination IP address, source port number, and/or destination port number.  \nACLs can be used to filter traffic for various purposes including security, monitoring, route selection, and network address translation. ACLs are comprised of one or more Access Control Entries (ACEs) . Each ACE is an individual line within an ACL.  \nRules for Access-Control Lists  \n• Packets are evaluated against entries in an ACL in sequential order.  \n• Once a packet matches an entry, no further evaluation is done.  \n• There is an implicit “deny any” at the end ofevery ACL, so any packet not explicitly permitted is implicitly denied. In other words, if a packet does not match any entry in an ACL, that packet is dropped.  \nsoundthinking point: Order of entries in an ACL is important  \nWhen building ACLs, put entries in order from most specific to most general.  \nTypes of Access-Control Lists  \nThere are fundamentally two types of access-control lists: standard ACLs and extended ACLs. Standard ACLs filter based only on the source IP address of a packet. Extended ACLs filter based on the source and/or destination IP address, protocol type such as IP, TCP, UDP, ICMP, and others, and source and/or destination TCP/UDP port numbers.  \nACL Syntax  \nACLs on a Cisco ASA Security Appliance are similar to those on a Cisco router, but not identical. Firewalls use real subnet masks instead of the inverted mask used on a router. ACLs on a firewall are named instead of numbered and assumed to be an extended list. The syntax of an ACE is relatively straight-forward, as you can see on the following page:  \nciscoasa(config)\\#access-listname [linenumber] [extended]{permit | deny} protocolsource_ IP_address source_netmask [operator source_port] destination_ IP_address destination_netmask [operator destination_port] [log [[disable | default] | [level]] [intervalseconds]] [timerangename] [inactive]  \nCreating an access control list (ACL)  \nIn the above example, an ACL called “demo1” is created in which the first ACE permits TCP traffic originating on the [10.1.0.0](10.1.0.0) subnet to go to any destination IP address with the destination port of 80 (www) . In the second ACE, the same traffic flow is permitted for destination port 443. Notice in the output of the show access-listthat line numbers are displayed and the extended parameter is also included, even though neither was included in the configuration statements.  \nYou can deactivate an ACE without deleting it by appending the inactive option to the end of the line.  \nPage | 2  \nAs with Cisco routers, there is an implicit “deny any” at the end ofevery ACL. Any traffic that is not explicitly permitted is implicitly denied.  \nEditing ACLs and ACEs  \nNew ACEs are appended to the end of the ACL. If you want, however, to insert the new ACE at a particular location within the ACL, you can add the line number parameter to the ACE:  \nEditing an access control list  \nNotice in the fifth line of the example above that an ACE is added at line two in the ACL. Notice in the output from the show access-list demo1 command that the new entry is added in the second position in the ACL and the former second entry becomes line number three.  \nYou can remove an ACE from an ACL by preceding the ACE configuration statement with the modifie","cbCaipUilIneJGFQ","https://ap.wps.com/l/cbCaipUilIneJGFQ","pdf",364833,"English","# Understanding Access Control Lists\n## Rules for Access-Control Lists\n# Types of Access-Control Lists\n# ACL Syntax on Cisco ASA\n# Creating an Access Control List (ACL)\n# Editing ACLs and ACEs\n## Inserting ACEs by Line Number\n## Removing an ACE with “no”\n# Time Ranges with ACEs\n## Naming and Creating Time Ranges\n# Renaming Access-Lists\n# Object Groups\n## Types of Object Groups\n## Configuring and Using an Object Group","[{\"question\":\"How are packets evaluated against a Cisco ASA ACL?\",\"answer\":\"Packets are evaluated against ACL entries in sequential order. Once a packet matches an entry, no further evaluation occurs.\"},{\"question\":\"What happens if a packet does not match any ACL entry?\",\"answer\":\"Cisco ASA ACLs include an implicit “deny any” at the end, so any packet not explicitly permitted is implicitly denied.\"},{\"question\":\"What is the difference between standard and extended ACLs on ASA?\",\"answer\":\"Standard ACLs filter only on the source IP address. Extended ACLs can filter on source/destination IPs, protocol types, and TCP/UDP port numbers.\"}]","Fundamentals of Cisco ASA Security Appliance Access-Control Lists | PDF",1790290029]