ACL Blocking the Wrong Traffic (Implicit Deny)
Every Cisco ACL ends with an invisible deny any any. The moment you apply an ACL, everything you did not explicitly permit is dropped. Combined with top-down first-match processing, this is why a single-line ACL appears to break the entire network.
What you see
R1# show access-lists
Extended IP access list BLOCK_GUEST
10 permit tcp 192.168.10.0 0.0.0.255 any eq www (241 matches)
! implicit deny ip any any <-- invisible, drops everything elseWhy it happens
ACLs are processed top-down and stop at the first match. If no line matches, the implicit deny ip any any at the end drops the packet. It never appears in the configuration, which is exactly why it catches people out.
The second trap is ordering: a broad permit placed above a specific deny means the deny is never evaluated. The third is direction — an ACL applied in filters traffic entering the interface, which is a completely different set of packets from out.
How to confirm it
show access-lists show ip interface GigabitEthernet0/0 | include access list show run | include access-class|ip access-group
The per-line match counters in show access-lists are the fastest diagnostic available: a rule with zero matches is never being hit, and traffic dying with no counter increment means the implicit deny caught it.
The fix
ip access-list extended BLOCK_GUEST permit tcp 192.168.10.0 0.0.0.255 any eq www permit tcp 192.168.10.0 0.0.0.255 any eq 443 permit udp 192.168.10.0 0.0.0.255 any eq 53 permit icmp any any echo-reply deny ip any any log ! interface GigabitEthernet0/0 ip access-group BLOCK_GUEST in
Adding an explicit deny ip any any log at the end changes nothing functionally, but it gives you match counters and log entries for the dropped traffic — turning an invisible failure into a visible one.
How to stop it happening again
Write the specific rules first and the general ones last, always permit return traffic such as DNS and established sessions, and test from a real client before leaving.
Questions people ask
Why does everything break when I apply one permit line?
Because of the implicit deny. Your one line permits its traffic and the invisible final rule denies everything else, including DNS, DHCP and your own management session.
Should I use inbound or outbound ACLs?
Filter as close to the source as possible, which usually means inbound on the interface where traffic enters. Inbound also saves the router routing a packet it is about to drop.
Related reading
How Acls WorkHow To Configure An AclInbound Vs Outbound AclShow Access Lists Command
Reading the fix is not the same as doing it
Every fault on this page can be broken and repaired on real Cisco routers and switches in our Ahmedabad lab — which is how it stops being theory. Come and see the rack before you pay anything.