⚠️ Prima di leggere: hai guardato i contatori match in show ip access-lists? Quale regola ha match elevati? Controlla anche dove l'ACL è applicata con show run | section interface.
BUG 1
ACL 10 applicata in direzione out invece di in su Gi0/1
🔍 Come identificarlo:
R1# show run | section interface
interface GigabitEthernet0/1
ip address 192.168.20.1 255.255.255.0
ip access-group 10 out ← sbagliato! Il traffico SSH entra (in)
R1# show ip access-lists 10
Standard IP access list 10
10 permit host 192.168.20.1 (0 matches) ← zero match!
20 deny any (0 matches)
🔧 Fix:
R1# conf t
R1(config)# interface GigabitEthernet0/1
R1(config-if)# no ip access-group 10 out
R1(config-if)# ip access-group 10 in
Perché funziona: con direzione out, l'ACL controlla il traffico che esce dall'interfaccia verso la LAN MGMT — cioè le risposte di R1 agli host. Con in controlla il traffico che entra da LAN MGMT verso R1 — quello che vogliamo filtrare (le richieste SSH).
BUG 2
ACL 100 — wildcard 0.0.0.7 invece di 0.0.0.255
🔍 Come identificarlo:
R1# show ip access-lists 100
Extended IP access list 100
10 deny tcp any host 192.168.10.0 eq www (0 matches)
20 permit tcp 192.168.10.0 0.0.0.7 any eq www (8 matches)
30 permit tcp 192.168.10.0 0.0.0.255 any eq 443 (12 matches)
40 permit icmp 192.168.10.0 0.0.0.255 any (5 matches)
← wildcard 0.0.0.7 = solo .0-.7, gli host .8-.254 bloccati!
🔧 Fix:
R1# conf t
R1(config)# ip access-list extended 100
R1(config-ext-nacl)# no 20
R1(config-ext-nacl)# 20 permit tcp 192.168.10.0 0.0.0.255 any eq www
Perché funziona: la wildcard 0.0.0.7 ha i bit 0-2 liberi → matcha solo 8 indirizzi (.0 ÷ .7). Con 0.0.0.255 tutti i 254 host della /24 sono inclusi.
BUG 3
ACL 100 — regola 10 blocca HTTP prima che la regola 20 lo permetta
🔍 Come identificarlo:
R1# show ip access-lists 100
Extended IP access list 100
10 deny tcp any host 192.168.10.0 eq www ← BLOCCA tutto HTTP!
20 permit tcp 192.168.10.0 0.0.0.255 any eq www (0 matches)
← la regola 20 non viene mai raggiunta (first match!)
🔧 Fix:
R1# conf t
R1(config)# ip access-list extended 100
R1(config-ext-nacl)# no 10
Perché funziona: le ACL usano il principio first match — la prima regola che corrisponde viene applicata e le successive ignorate. La regola 10 deny any ... eq www matcha tutto il traffico HTTP prima che la regola 20 possa permetterlo. Rimuovendo la regola 10 errata, il traffico HTTP raggiunge la regola 20 e viene permesso.
🧠 Come ragionare su un problema ACL
Passo 1 — Leggi i contatori match
show ip access-lists — quale regola ha match elevati? Se una regola deny ha molti match, sta bloccando traffico. Se una regola permit ha zero match, non viene mai raggiunta (c'è qualcosa prima che la intercetta).
Passo 2 — Verifica dove è applicata
show run | section interface — l'ACL è sull'interfaccia giusta? In direzione giusta (in vs out)? Ricorda: standard vicino alla destinazione, extended vicino alla sorgente.
Passo 3 — Controlla l'ordine delle regole
First match wins — l'ordine conta. Una deny troppo generica prima di un permit blocca tutto. Cerca regole con zero match dopo regole deny con molti match.
Passo 4 — Verifica la wildcard mask
show run | section access-list — la wildcard è corretta? Per una /24 → 0.0.0.255. Una wildcard troppo stretta (es. 0.0.0.7) include solo 8 host.
📋 Concetti chiave — ACL
First Match
Le ACL vengono elaborate dall'alto verso il basso.
La prima regola che corrisponde viene applicata.
Le regole successive vengono ignorate.
Implicit deny any alla fine — se nessuna regola matcha, il traffico è bloccato.
in vs out
in = traffico che entra nell'interfaccia (verso il router)
out = traffico che esce dall'interfaccia (dal router)
Standard ACL → vicino alla destinazione
Extended ACL → vicino alla sorgente
Standard vs Extended
Standard (1-99, 1300-1999): filtra solo IP sorgente
Extended (100-199, 2000-2699): filtra src IP, dst IP, protocollo, porta
Named ACL: più flessibile, permette rimozione singola regola
Wildcard mask ACL
0 = bit deve corrispondere
1 = bit può essere qualsiasi
0.0.0.255 = intera /24
0.0.0.0 = host esatto
0.0.0.7 = solo 8 host (.0-.7)
🔍 Teoria — Bug 1: direzione in/out sbagliata
Con ACL in direzione out su Gi0/1, l'ACL controlla il traffico che il router invia verso la LAN MGMT — principalmente le risposte SSH di R1. Le richieste SSH degli host (direzione in) passano liberamente senza essere filtrate. Questo spiega perché l'ACL ha zero match: il traffico SSH in entrata non viene mai confrontato con le regole.
🔍 Teoria — Bug 2: wildcard 0.0.0.7
La wildcard 0.0.0.7 in binario è 00000111 — i 3 bit meno significativi sono liberi (1), gli altri devono corrispondere (0). Questo significa che solo gli indirizzi che differiscono negli ultimi 3 bit sono inclusi: .0, .1, .2, .3, .4, .5, .6, .7. A partire da .8 (00001000) il bit 3 è diverso → non corrisponde alla wildcard → traffico bloccato dall'implicit deny.
🔍 Teoria — Bug 3: ordine regole (first match)
La regola 10
deny tcp any host 192.168.10.0 eq www contiene un errore logico: usa
any come sorgente — matcha qualsiasi traffico TCP HTTP. Quando un host .10 tenta HTTP, la regola 10 matcha per prima (first match) e blocca. La regola 20 permit non viene mai valutata. Rimuovendo la regola 10 sbagliata, il traffico HTTP raggiunge la regola 20 e viene permesso correttamente.
show ip access-lists ← contatori match per regola
show run | section access-list ← testo completo ACL
show run | section interface ← dove è applicata e in quale direzione
show ip interface <iface> ← inbound/outbound access list
🇬🇧 English version — Cisco official terminology for CCNA exam preparation.
BUG 1
ACL 10 applied in wrong direction (out instead of in) on Gi0/1
🔍 How to identify:
R1# show run | section interface
interface GigabitEthernet0/1
ip access-group 10 out ← wrong! SSH traffic comes IN
R1# show ip access-lists 10
10 permit host 192.168.20.1 (0 matches) ← never evaluated
🔧 Fix:
R1# configure terminal
R1(config)# interface GigabitEthernet0/1
R1(config-if)# no ip access-group 10 out
R1(config-if)# ip access-group 10 in
Why this works: With out, the ACL filters traffic leaving the interface toward the LAN — R1's replies. The inbound SSH requests from management hosts bypass the ACL entirely. Zero matches confirm it: the ACL is never evaluated for the traffic direction we want to control.
📋 Key concept — ACL placement rules
• Standard ACL: place close to the destination (to avoid blocking too much)
• Extended ACL: place close to the source (to drop traffic early)
• in: filters packets entering the interface (from network toward router)
• out: filters packets leaving the interface (from router toward network)
• Zero match counter → ACL not in the right position/direction
BUG 2
ACL 100 — wildcard 0.0.0.7 matches only 8 hosts (.0-.7)
🔍 How to identify:
R1# show ip access-lists 100
20 permit tcp 192.168.10.0 0.0.0.7 any eq www
← only .0 to .7 are permitted. Hosts .8+ are blocked by implicit deny
🔧 Fix:
R1# configure terminal
R1(config)# ip access-list extended 100
R1(config-ext-nacl)# no 20
R1(config-ext-nacl)# 20 permit tcp 192.168.10.0 0.0.0.255 any eq www
Why this works: Wildcard 0.0.0.7 in binary is 00000111 — only the last 3 bits are wildcarded, matching 8 addresses (.0 to .7). Hosts from .8 onward don't match and hit the implicit deny. The correct wildcard for a /24 subnet is 0.0.0.255 (all 8 host bits wildcarded).
📋 Key concept — Wildcard mask bits
• 0 bit = must match exactly | 1 bit = any value accepted
• 0.0.0.255 = entire /24 (254 hosts)
• 0.0.0.7 = only 8 hosts (.0 to .7) — 3 bits free
• 0.0.0.0 = exact host match
• Formula: wildcard = 255.255.255.255 − subnet mask
BUG 3
ACL 100 — deny rule (seq 10) blocks HTTP before permit rule (seq 20)
🔍 How to identify:
R1# show ip access-lists 100
10 deny tcp any host 192.168.10.0 eq www (47 matches)
20 permit tcp 192.168.10.0 0.0.0.255 any eq www (0 matches)
↑ high match on deny + zero on permit = first-match problem
🔧 Fix:
R1# configure terminal
R1(config)# ip access-list extended 100
R1(config-ext-nacl)# no 10
Why this works: ACLs use first-match processing — the first matching rule wins, all subsequent rules are skipped. Rule 10 (deny tcp any ... eq www) matches all HTTP traffic before rule 20 can permit it. Removing rule 10 allows HTTP to reach rule 20 and be permitted.
📋 Key concept — ACL first-match processing
• Rules evaluated top-down, first match applied, rest skipped
• A broad deny before a specific permit = traffic never reaches the permit
• Diagnostic: high match on deny + zero match on permit below = wrong order
• Named ACLs allow removing individual rules with no <seq-number>
• Implicit deny any always at the end (not shown in output)
🎯
Exam Practice — ACL Troubleshooting
3 questions · CCNA 200-301 style · answer before checking
0/3
Q1.
An administrator applies a standard ACL to restrict SSH access to a router. After applying the ACL, all hosts can still SSH to the router and show ip access-lists shows 0 matches. What is the most likely cause?
A) The ACL is missing a permit statement for the allowed host
B) The ACL is applied in the wrong direction (out instead of in) on the interface
C) Standard ACLs cannot be used to filter SSH traffic
D) The ACL number is in the extended range and must be 100-199
Q2.
An extended ACL contains the following rule:
permit tcp 10.1.0.0 0.0.0.15 any eq 80
Hosts 10.1.0.1 through 10.1.0.10 can browse the web, but 10.1.0.20 cannot. What is the problem?
A) The ACL should use subnet mask 255.255.255.240 instead of wildcard
B) The wildcard mask 0.0.0.15 only matches 16 hosts (.0 to .15) — host .20 is outside the range
C) Host 10.1.0.20 needs a separate permit statement
D) Port 80 should be specified as destination, not eq
Q3.
A network administrator notices that show ip access-lists shows a deny statement with 500 matches and the permit statement below it with 0 matches. What does this indicate?
A) The permit statement is not needed because the deny already handles all traffic
B) The deny statement is blocking all traffic that should be permitted — first-match processing prevents the permit from being evaluated
C) The ACL needs to be reapplied to the interface to reset the counters
D) This is normal behavior — deny rules always have more matches than permit rules