Read routing decisions and ports.
An ACL checks packets against ordered rules
A standard IPv4 ACL matches source addresses. An extended ACL can also match destinations, protocols and ports. Rules are checked in order; the first match decides the action. If no entry permits the packet, an implicit deny applies. Applying a list to the wrong interface or direction can change the result completely.
Inbound and outbound are relative to the router interface, not the human reading the diagram. Inbound traffic enters that interface. Outbound traffic leaves it. A traditional interface ACL is generally stateless: allowing one packet does not automatically create a stateful return-traffic permission.
NAT changes addressing
Static NAT provides a fixed mapping. Dynamic NAT uses mappings from a pool. Port address translation (PAT), also called overload, lets multiple inside conversations share translated addressing using transport information or other identifiers. Inside and outside roles must match the design.
An ACL used to select traffic for NAT is not automatically an interface security filter. NAT does not encrypt traffic and should not be described as a complete security control. A translation entry also does not prove that the destination application is healthy; check routes and return traffic separately.
Verification commands
Use these viewing commands to inspect the idea in this lesson. Start in the environment shown above each example.
show access-lists
show ip nat translationsCommand reference · enter in the stated environment; output varies by device.
Practical exercise
A NAT selection ACL permits a subnet, but it has not been applied as an interface access group. Has that fact alone installed a traffic-blocking interface policy?
Show the answer and explanation
No. The ACL is being used to select translation traffic in that configuration. Interface filtering requires its own application and policy design.
QUICK KNOWLEDGE CHECK
Check your understanding
Related labs and exercises
Sources & content checks
Technical references checked on 25 October 2026. These are original teaching explanations, not official Cisco course material. See how content and lab validation are described.
Your progress
Mark this complete when you can explain the example and do the exercise.