In the end of every ACL there is an implicit deny any!

There are three ACL types:

1. Standard - filter based on source IP
2. IP ACL - filter based on src/dst IP, port, protocol
3. MAC ACL - filter based on src/dst MAC address. Can be applied only to “inbound” direction

Example Standard ACL:

ip access-list standard ACL-BGP-PEER
   10 permit 172.22.1.0/31
!
interface Ethernet32/1
   ip access-group ACL-BGP-PEER in

Example IP ACL:

ip access-list ACL-BGP-PEER
   10 permit ip 172.22.1.0/31 172.22.1.0/31

Example MAC ACL (allowing arp traffic sourcing from 00:10:10:00:xx:xx):

mac access-list MAC-ACL-TEST
   10 permit 00:10:10:00:10:00 00:00:00:00:ff:ff any arp

Applying ACL to the management traffic:

management ssh
   ip access-group ACL-SSH-USERS in

Applying ACL to all management protocols:

system control-plane
   ip access-group CONTROL-PLANE-PROTECTION-V4 in