Cisco IOS ACL Generator
Render shared firewall-rule JSON as a review-only Cisco IOS named extended ACL subset.
This tool handles input and primary processing in your browser and is designed not to send the input to QuickKit’s server.
Avoid live production secrets; use dummy or masked data where possible. Data handling details
Cisco IOS ACL definition
drop is rendered as deny. Once the ACL is applied to an interface, IOS can generate ICMP unreachable messages for denied packets (enabled by default, rate-limited). no ip unreachables or no ipv6 unreachables on the interface where the traffic arrives stops them, but it changes the behavior of the entire interface; it is not scoped to this ACL entry. See How it works for side effects.
How it works
Imports only shared firewall-rule JSON and renders an unattached Cisco IOS named extended IPv4 or IPv6 ACL definition called QUICKKIT. IPv4 CIDRs become IOS wildcard masks; IPv6 addresses use IPv6 ACL syntax. The bounded subset accepts only the model's input label, because ACL direction, interface attachment, chain semantics, and conntrack state are not portable. No interface or application commands are generated. The model's drop is a silent discard, but interface ACL filtering can cause IOS to generate ICMP unreachable messages to the source. ICMP unreachable generation is enabled by default and rate-limited (IPv4: once every 500 ms by default, set with ip icmp rate-limit unreachable; IPv6: ipv6 icmp error-interval). For a silent drop, configure no ip unreachables or no ipv6 unreachables on the interface where the denied traffic arrives. That setting changes the behavior of the entire interface; it is not scoped to this ACL entry. On IPv4, disabling ICMP unreachables with no ip unreachables also affects IP Path MTU Discovery on that interface. reject is not supported because IOS controls that response per interface, not per entry. Review implicit ACL behavior and target IOS release before use.