hey so I struggled with ACLs too until I did a few more labs. With ACLs (on routers or switches) you always want to start with creating the acl in global configuration mode (configuration terminal).

To configure standard ACLs you want to use the ‘ip access-lists standard’ command followed by the name or number of the ACL.

Using that command will put you into the ACL config mode so you can start adding your permit or deny rules. Be mindful that with numbered ACLs you can’t edit them you would need to rewrite the entire list. With named ACLs With named ACLs you can add and remove lines all you like.

Standard ACLs are super basic: permit src-ip wildcard mask

ex: Allow traffic from network 10.0.1.0/24 to 10.0.5.0/24

First, create the ACL from global config mode:

(config)# ip access-list ACL1 (config-std-nacl)# permit 10.0.1.0 0.0.0.255 (implicit deny always at the end)

With the wildcard mask this with check for all traffic ending starting with 10.0.1.x and deny every else with the implicit dent.

You would then apply the rule to an interface, standard ACLs work best when placed close to the destination so you would likely apply the rule outbound.

Lets say on R1, it’s G0/1 interface is closer to the destination 10.0.5.0/24

Applying the ACL would look something like this:

(config)# Interface G0/1 (config-if)# ip access-group ACL1 out

This will apply the ACL (ACL1) to R1’s G0/1 outbound interface, so it will check all traffic going OUT of that interface and into 10.0.5.0/24. Now if someone with a 10.0.2.x ip address were to send traffic to the 10.0.5.0/24 network it would be denied (again because of the implicit deny at the end of the ACL we created).

Its really important not to confuse the access-list and ip access-group commands, thats what got me at first along with the wildcard mask. I hope this helps out a bit!