Is it necessary to provide a wildcard mask in extended ACL?

For example, if I want to block from gaining access to, can I write the command as follows?

access-list 107 deny
acess-list 107 permit any any
int fa 0/0
ip access-group in

2 Answers 2


You are wrong.

The correct syntax is:

access-list 107 deny ip host
access-list 107 permit ip any any

int fa 0/0
ip access-group 107 in is the ACL wildcard of which is a single host (/32). is the ACL wildcard of which is a whole /24 subnet.

  • One thing that s confusing me is that when to use and when to use as wildcard mask? Apr 23, 2019 at 7:25
  • 2 when there is host. when subnet is /24
    – infra
    Apr 23, 2019 at 7:26
  • @AhmadQayyum check my updated answer. :-)
    – Cow
    Apr 23, 2019 at 7:28
  • 1
    @AhmadQayyum yes exactly.
    – Cow
    Apr 23, 2019 at 7:33
  • 1
    @Zac67 you are correct, i've changed the text.
    – Cow
    Apr 23, 2019 at 10:39

ACLs use wildcards. You need to use e.g.

ip access-list 107 deny ip

The /32 is equivalent to the wildcard = no wildcard bits. Alternatively, you can use the host indicator, so,, and host are all the same. any is equivalent to = all wildcard bits = any IP address.

Additionally, you should consider numbering your ACL entries to simplify future expansion, e.g.

ip access-list extended 107
10 deny ip
9999 permit any any
  • On all the routers i have available, Cisco 6509-E with Sup2T, Cisco 897, Cisco 3650/3850 etc. I do not have the command access-list extended. Only numbers are available that represent the extended, standard, protocol etc. All are running the latest Safe harbor software.
    – Cow
    Apr 23, 2019 at 10:36
  • I'm guessing you mean ip access-list extended 107
    – Cow
    Apr 23, 2019 at 10:44
  • @user56700 Thx, the ip was missing. The syntax does vary a bit but with the ip bit that should work.
    – Zac67
    Apr 23, 2019 at 17:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.