ACL

What is an ACL?

An ACL (Access Control List) is an ordered list of permit and deny rules on a router, switch or firewall that decides for every network packet whether it may pass, based on attributes such as source and destination address, protocol and port number. ACLs are the simplest and fastest form of traffic filtering and are found in almost every IT and OT network. In industrial environments they enforce segmentation between zones, so that, for example, only the SCADA server may talk to a PLC.

ACLs enable least-privilege networking: only the traffic a process genuinely needs is allowed.

🧠 How does an ACL work?

An ACL consists of rules (access control entries) that the router or switch evaluates from top to bottom. Each rule compares a packet with a set of attributes:

• Source and destination IP - a single address, a subnet or any
• Protocol - for example TCP, UDP or ICMP
• Port number - for example 443 for HTTPS or 502 for Modbus TCP
• Direction - the ACL is bound to an interface and filters either inbound or outbound traffic

Three rules govern its behaviour:

1. The first match wins. As soon as a rule matches, the device applies the action and stops searching. A broad permit at the top therefore makes every specific deny below it useless.
2. There is an implicit deny at the end. Every ACL ends with an invisible “deny everything else” rule. An ACL without at least one permit therefore blocks all traffic.
3. One ACL per interface, per direction, per protocol. If you need more rules, you edit the existing list rather than adding a second one.

An example in Cisco IOS notation, in which only the SCADA network may reach the PLC over Modbus TCP and OPC UA:

ip access-list extended OT-CELL-IN
 10 permit tcp 192.168.10.0 0.0.0.255 host 192.168.20.15 eq 502
 20 permit tcp host 192.168.10.5 host 192.168.20.15 eq 4840
 30 deny ip any any log

The mask 0.0.0.255 is a wildcard mask: the inverse notation of a subnet mask, here equivalent to a /24. The explicit deny with log at the end does the same as the implicit deny, but makes blocked traffic visible in hit counters and syslog.

🔧 What types of ACL are there?

On switches, ACLs run in dedicated memory (TCAM), so filtering happens at line rate. That memory is limited: once it is full, some platforms send traffic through the CPU instead and performance drops.

🔍 What is the difference between an ACL and a firewall?

An ACL is stateless: each packet is judged on its own, without knowledge of the session it belongs to. Return traffic therefore has to be permitted separately. The Cisco established keyword helps only partially: it permits TCP segments with the ACK or RST flag set, but does not check whether a session really exists. A firewall does track the state of connections.

An industrial firewall or next-gen firewall can, for instance, tell whether a Modbus packet contains a read request (function code 3) or a write request (5, 6, 15 or 16). To an ACL, both are simply TCP traffic to port 502.

🏭 How do you use ACLs in OT networks?

In OT, ACLs are often the first layer of network segmentation, particularly on layer 3 switches between cells and levels of the Purdue Model. Typical uses:

• Allowing only specific PLCs to communicate with the SCADA server
• Restricting access to HMIs to specific subnets or workstations
• Blocking unwanted protocols, such as SMB or Telnet in the OT segment
• Shielding Safety PLCs from every connection except the one from the engineering station
• Restricting management access, so that SSH and web interfaces of switches can only be reached from a jump server

To do this, you need to know which ports industrial protocols use:

Take care with ProfiNET: its real-time traffic runs directly over Ethernet (EtherType 0x8892) and cannot be routed. An IP ACL only sees the connection set-up via UDP 34964; you separate the cyclic traffic at layer 2, using VLANs or MAC ACLs.

🧭 How do you build an ACL policy step by step?

1. Map the traffic flows. Use passive monitoring or Wireshark to see who talks to whom, without disturbing the process.
2. Draw up a communication matrix. Record for each zone and conduit which source, destination, protocol and port are needed, and why.
3. Work on a deny by default basis. IEC 62443-3-3 requires at zone boundaries (SR 5.2), from security level 2 upwards, that traffic is denied by default and allowed only by exception.
4. Order rules carefully. Specific rules at the top, extended ACLs close to the source, and an explicit deny with logging at the bottom.
5. Test during a maintenance window. A forgotten rule can break a PLC connection and stop a process. Keep a fallback configuration ready.
6. Log and monitor. Send deny messages to a SIEM, so that scans and misconfigured devices stand out.
7. Manage changes. Record every rule through change management and review the rule set periodically, as described under firewall rule management.

Do not forget IPv6: an IPv4 ACL does not filter IPv6 traffic. If IPv6 is enabled on devices, you need a separate IPv6 ACL or should disable IPv6. Note one difference: in an IPv6 ACL, Cisco IOS permits neighbour discovery messages (NS and NA) by default ahead of the implicit deny, because IPv6 does not work without them. If you add your own explicit deny ipv6 any any at the bottom, you must permit those messages explicitly first.

🔐 What are the limitations and risks of ACLs?

• No identity - an ACL knows IP addresses, not users. Anyone who takes over or spoofs a permitted address gets through. Combine ACLs with RBAC, port security or Zero Trust.
• Order-sensitive - a single misplaced rule can open up too much or block critical communication
• Growth and clutter - rules that nobody understands any more remain in place for years
• No content inspection - protocol inspection requires DPI or an industrial firewall

Legislation makes access policy explicit. NIS2 lists access control policies as a mandatory measure in Article 21(2)(i); in the Netherlands this is implemented through the Dutch Cybersecurity Act (Cyberbeveiligingswet). NIST SP 800-82 (Rev. 3, September 2023) recommends ACLs and firewalls as part of defence in depth.

❓ Frequently asked questions

Is an ACL the same as a firewall?

No, an ACL is a stateless filter that judges each packet on its own using header fields such as address, protocol and port. A firewall tracks the state of connections and can often inspect protocol content as well. In OT networks, ACLs and firewalls are usually combined.

What does the implicit deny in an ACL mean?

The implicit deny is an invisible final rule that blocks all traffic not permitted earlier in the ACL. As a result, every ACL must contain at least one permit rule. Many administrators add an explicit deny with logging at the bottom so that blocked traffic becomes visible.

Where is the best place to apply an ACL?

You place an extended ACL as close to the source as possible, so unwanted traffic does not load the network unnecessarily. A standard ACL filters on source address only and belongs close to the destination, otherwise it also blocks traffic to other destinations. In OT, the natural place for an ACL is the boundary between zones.

Can an ACL filter PROFINET traffic?

An IP ACL cannot filter cyclic PROFINET traffic, because it runs directly over Ethernet with EtherType 0x8892 and does not use IP. Only the connection set-up via UDP port 34964 is IP traffic. PROFINET networks are therefore separated with VLANs or MAC ACLs at layer 2.

Are there ACLs outside networking?

Yes, operating systems use ACLs to define permissions on files and folders. Windows uses a DACL for access rights and a SACL for auditing on NTFS, and Linux supports POSIX ACLs. The principle is the same: a list that defines what each subject is allowed to do.

Do ACLs make you compliant with IEC 62443?

ACLs can help meet zone boundary protection requirements in IEC 62443-3-3, such as the deny by default, allow by exception principle. From security level 3, the same requirement adds island mode and fail close, and the standard also sets requirements for authentication and monitoring, which in practice call for stateful firewalls and detection. ACLs are therefore a building block, not a complete solution.

📌 In summary

An ACL is an ordered list of permit and deny rules that routers and switches use to filter network traffic by IP address, protocol and port, with the first match winning and an implicit deny at the end. In industrial networks, the ACL is a fast, low-cost building block for segmentation, security and least privilege, provided it is combined with firewalls, monitoring and sound change management.