Hello! In our last lesson, we focused on standard numbered ACLs, learning how to filter traffic based solely on its source IP address. We established the core principles of ACL processing, including the implicit deny rule and the best practice of placing standard ACLs near the destination.
This lesson builds directly on that foundation by introducing a much more powerful and flexible tool: extended named Access Control Lists. You will learn how to configure and apply an ACL that filters traffic with high precision, using criteria like source and destination IP addresses, the protocol being used (like TCP or UDP), and even specific port numbers for applications like web or FTP. This level of granular control is essential for implementing robust security policies, a key skill for your upcoming project.
From Standard to Extended: Gaining Granular Control
While standard ACLs are useful, their "all-or-nothing" approach to a source IP can be too broad. Extended ACLs solve this by allowing you to inspect deeper into the packet headers.
Key features of extended ACLs include:
- Filtering by Protocol: You can specify IP, TCP, UDP, ICMP, and others.
- Filtering by Source and Destination IP: Unlike standard ACLs, you can define rules based on where traffic is coming from and where it's going.
- Filtering by Port Number: You can permit or deny traffic for specific services (e.g., allow web traffic on port 80 but block Telnet on port 23).
Because of this specificity, the placement rule is reversed:
Rule of Thumb: Place extended ACLs as close to the source of the traffic as possible.
This is more efficient. Since you can precisely define the traffic you want to block, it's best to drop it as soon as it enters the network, saving router resources that would otherwise be wasted forwarding a packet only to be dropped later.
Extended Named ACLs: Syntax and Configuration
We'll focus on named ACLs, as they are more descriptive and easier to manage than numbered ACLs. To create one, you use the ip access-list extended <NAME> command, which takes you into a dedicated configuration mode.
Let's dive into the details of the syntax.
Free CCNA | Extended ACLs | Day 35 | CCNA 200-301 Complete Course
This video from Jeremy's IT Lab provides a clear walkthrough of the components that make up an extended ACL rule. It covers how to specify protocols and, most importantly, how to filter by Layer 4 port numbers.
First, watch the section on protocol and address matching. This explains how to enter the named ACL configuration mode and specify protocols like tcp, udp, icmp, or ip (for all protocols). Next, watch the segment on port number matching. This is the most critical part. Pay close attention to the operators eq (equal), gt (greater than), lt (less than), neq (not equal), and range. Also, note that you can use either the port number (e.g., 80) or a keyword (e.g., www).
To effectively use port-based filtering, you need to know which port numbers correspond to which services.
Configure Extended Access Control List Step by Step Guide
This article from ComputerNetworkingNotes includes a handy reference table of common applications and their associated protocols and port numbers.
Review the section titled "Port numbers/names" and the table provided. You don't need to memorize all of them right now, but be familiar with the most common ones like FTP (21), Telnet (23), DNS (53), HTTP (80), and HTTPS (443).
Lab: Building and Applying an Extended Named ACL
Now it's time to put these concepts into practice. We'll walk through a full lab scenario where we need to implement several specific filtering rules.
The general workflow remains the same as with standard ACLs:
- Create the named ACL and its access control entries (ACEs).
- Apply it to the correct interface in the correct direction (
inorout). - Verify its operation.
Free CCNA | Extended ACLs | Day 35 | CCNA 200-301 Complete Course
This lab demonstration is the core of our lesson. You will see how to translate a set of security requirements into a functional extended ACL configuration on a router.
Watch the entire lab walkthrough from configuring extended ACLs. Pay attention to: How each requirement is translated into a specific deny or permit statement. The placement of the ACLs (e.g., inbound on G0/1, inbound on G0/2, outbound on G0/0) to enforce the rules efficiently near the source. The critical permit ip any any statement at the end of the ACLs to allow all other traffic.
The video provides an excellent dynamic demonstration. For a static example that clearly lays out the rules and corresponding commands, refer to the image below.
Modifying an Existing ACL
One of the main advantages of named ACLs is that they are easy to edit. Unlike numbered ACLs (which you configure from global config mode), you can enter the named ACL's configuration mode and insert or delete individual lines using sequence numbers without having to delete the whole list.
Configure Extended Access Control List Step by Step Guide
This guide provides a practical example of how to modify an existing named ACL.
Read the section "Updating the extended ACL". The key commands here are: show ip access-lists to view the current ACEs with their sequence numbers. ip access-list extended <NAME> to enter the configuration mode. <sequence-number> permit/deny ... to insert a new line at a specific position.
Verification Commands
After applying your ACL, you need to confirm it's working.
show access-lists: You've used this before. For extended ACLs, it shows the full rule, including protocol and port information. Crucially, it also shows the "match count" for each line, which tells you if your rule is actually filtering packets.show ip interface <interface>: This command confirms which ACL is applied to an interface and in which direction (inorout).
Let's see a quick demonstration of the second command.
Free CCNA | Extended ACLs | Day 35 | CCNA 200-301 Complete Course
This short clip shows how to use show ip interface to verify ACL application.
Watch the segment from verifying ACLs. You'll see the "Inbound access list" and "Outbound access list" fields in the output.
Conclusion
In this lesson, you have significantly expanded your traffic filtering capabilities. You are no longer limited to just the source IP; you can now create precise rules to control exactly what kind of traffic is allowed between specific hosts and services.
Key Takeaways:
- Extended named ACLs are created with
ip access-list extended <NAME>. - They filter based on protocol, source IP, destination IP, and port numbers.
- The best practice is to apply extended ACLs as close to the source as possible.
- The syntax for an entry is
permit|deny <protocol> <source> <dest> [operator <port>]. - Named ACLs can be easily modified using sequence numbers, which is a major advantage over numbered ACLs.
- Verification involves using
show access-liststo check hit counts andshow ip interfaceto confirm application.
You now have the skills to build both standard and extended ACLs. However, configuration is only half the battle. In our next lesson, we will focus on troubleshooting ACLs. We will explore common mistakes and develop a systematic approach to diagnosing and fixing ACLs that aren't behaving as expected.