Extended ACLs
Extended ACLs function mostly the same as standard ACLs.
They can be numbered or named, just like standard ACLS.
Numbered ACLs use the following ranges: 100 - 199, 2000 - 2699
They are processed from top to bottom, just like standard ACLs.
However, they can match traffic based on more paremeters, so they are more precise (and more complex) than standard ACLs.
We will focus on matching based on these main parameters: Layer 4 protocol/port, source address, and destination address.
Matching protocol
Matching source/destination IP address
Practice
Matching TCP/UDP port numbers
When matching TCP/UDP, you can optionally specify the source and/or destination port numbers to match.
eq 80 = equal to port 80
gt 80 = greater than 80 (81 and greater)
lt 80 = less than 80 (79 and less)
neq 80 = not 80
range 80 100 = from port 80 to port 100
Deny all packets destinated for IP address 1.1.1.1/32, TCP port 80
After the destination IP address and/or destination port numbers, there are many more options you can use to match (not necessary for the CCNA).
ack: match the TCP ACK flag.
fin: match the TCP FIN flag.
syn: match the TCP SYN flag.
ttl: match packets with a specific TTL value.
dscp: match packets with a specific DSCP value.
If you specify the protocol, source IP, source port, destination IP, destination port, etc, a packet must match all of those values to match the ACL entry. Even if it matches all except one of the parameters, the packet won't match that entry of the ACL.
Practice
First requirement
Extended ACLs should be applied as close to the source as possible, to limit how far the packets travel in the nwtwork before being denied.
(Standard ACLs are less specific, so if they are applied close to the source there is a risk of blocking more traffic than intended)
Second requirement
Third requirement
All requirements
Checking the configurations.
Last updated