Is Access-group the old command of the Access-list for old routers? or they're just complete each other because when I do an Access-list I need to go to the port and use Access-group.

Or they are just separated commands complete each others?

1 Answer 1


Proceeding from the assumption that you are talking about Cisco gear, it is basically as you said, they complete each other. Neither an access-list nor an access-group on its own will have any effect.

In fact, you configure an access-list first, which contains the rules permitting or denying the traffic. You can match on things like source and destination address, layer 4 protocol and layer 4 port information (source and destination port as applicable). You however cannot specify where this policy should be applied.

This is where the access-group comes in. Using the access-group, you can apply a previously defined access-list to an interface and further configure the direction of traffic that should be filtered.

Consider the following example:

access-list 100 permit tcp host eq 443
interface GigabitEthernet 0/0
  ip access-group 100 in

Note that each access-list has an implicit deny ip any any at the end, which means that every traffic not permitted explicitly before will be dropped. To change that behaviour, you can put the following line at the end of the access-list:

access-list 100 permit ip any any

This applies the access list to Interface Gi 0/0 in the inbound direction, which means that the traffic is filtered when it enters the router using the specified interface.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.