Troubleshooting

ACL Blocking the Wrong Traffic (Implicit Deny)

Every Cisco ACL ends with an invisible deny any any. The moment you apply an ACL, everything you did not explicitly permit is dropped. Combined with top-down first-match processing, this is why a single-line ACL appears to break the entire network.

What you see

R1# show access-lists
Extended IP access list BLOCK_GUEST
    10 permit tcp 192.168.10.0 0.0.0.255 any eq www (241 matches)
    ! implicit deny ip any any  <-- invisible, drops everything else

Why it happens

ACLs are processed top-down and stop at the first match. If no line matches, the implicit deny ip any any at the end drops the packet. It never appears in the configuration, which is exactly why it catches people out.

The second trap is ordering: a broad permit placed above a specific deny means the deny is never evaluated. The third is direction — an ACL applied in filters traffic entering the interface, which is a completely different set of packets from out.

How to confirm it

show access-lists
show ip interface GigabitEthernet0/0 | include access list
show run | include access-class|ip access-group

The per-line match counters in show access-lists are the fastest diagnostic available: a rule with zero matches is never being hit, and traffic dying with no counter increment means the implicit deny caught it.

The fix

ip access-list extended BLOCK_GUEST
 permit tcp 192.168.10.0 0.0.0.255 any eq www
 permit tcp 192.168.10.0 0.0.0.255 any eq 443
 permit udp 192.168.10.0 0.0.0.255 any eq 53
 permit icmp any any echo-reply
 deny   ip any any log
!
interface GigabitEthernet0/0
 ip access-group BLOCK_GUEST in

Adding an explicit deny ip any any log at the end changes nothing functionally, but it gives you match counters and log entries for the dropped traffic — turning an invisible failure into a visible one.

How to stop it happening again

Write the specific rules first and the general ones last, always permit return traffic such as DNS and established sessions, and test from a real client before leaving.

Questions people ask

Why does everything break when I apply one permit line?

Because of the implicit deny. Your one line permits its traffic and the invisible final rule denies everything else, including DNS, DHCP and your own management session.

Should I use inbound or outbound ACLs?

Filter as close to the source as possible, which usually means inbound on the interface where traffic enters. Inbound also saves the router routing a packet it is about to drop.

Related reading

How Acls WorkHow To Configure An AclInbound Vs Outbound AclShow Access Lists Command

Reading the fix is not the same as doing it

Every fault on this page can be broken and repaired on real Cisco routers and switches in our Ahmedabad lab — which is how it stops being theory. Come and see the rack before you pay anything.

Start your networking career with Attila Technologies

Hands-on Cisco training, real lab devices and placement support in Ahmedabad.