# Extended ACLs

Extended ACLs function mostly the same as standard ACLs.

They can be numbered or named, just like standard ACLS.

* Numbered ACLs use the following ranges: **100 - 199, 2000 - 2699**

They are processed from top to bottom, just like standard ACLs.

However, they can match traffic based on more paremeters, so they are more precise (and more complex) than standard ACLs.

We will focus on matching based on these main parameters: **Layer 4 protocol/port, source address**, and **destination address**.

```
R1(config)# access-list <number> [permit | deny] <protocol> <src-ip> <dst-ip>
```

```
R1(config)# ip access-list extended {<name> | <number>}
R1(config-ext-nacl)# [<seq-num>] [permit | deny] <protocol> <src-ip> <dst-ip>
```

## Matching protocol

<figure><img src="https://1474932522-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FAgItg4KAZpnXjAFPWRf8%2Fuploads%2FW8jLJgC8YGC3CUy9o02H%2FScreenshot%20from%202023-07-25%2015-00-55.png?alt=media&#x26;token=e7ac4a4e-cde6-4be9-b680-215559bd067a" alt=""><figcaption></figcaption></figure>

## Matching source/destination IP address

<figure><img src="https://1474932522-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FAgItg4KAZpnXjAFPWRf8%2Fuploads%2FW8SlEmcUoZ1mxRhUsNTM%2FScreenshot%20from%202023-07-25%2015-02-24.png?alt=media&#x26;token=5e01e65f-64a5-4081-81f3-0c87b2b10dbe" alt=""><figcaption></figcaption></figure>

### Practice

<details>

<summary>Allow all traffic</summary>

```
R1(config-ext-nacl)# permit ip any any
```

</details>

<details>

<summary>Prevent 10.0.0.0/16 from sending UDP traffic to 192.168.1.1/32</summary>

```
R1(config-ext-nacl)# deny udp 10.0.0.0 0.0.255.255 host 192.168.1.1
```

</details>

<details>

<summary>Prevent 172.16.1.1/32 from pinging hosts in 192.168.0.0/24</summary>

```
R1(config-ext-nacl)# deny icmp host 172.16.1.1 192.168.0.0 0.0.0.255
```

</details>

## Matching TCP/UDP port numbers

When matching TCP/UDP, you can optionally specify the source and/or destination port numbers to match.

```
R1(config-ext-nacl)# deny tcp <src-ip> [eq | gt | lt | neq | range] <src-prt-num> <dst-ip> [eq | gt | lt | neq | range] <dst-port-num>
```

* **eq 80** = equal to port 80
* **gt 80** = greater than 80 (81 and greater)
* **lt 80** = less than 80 (79 and less)
* **neq 80** = **not** 80
* **range 80 100** = from port 80 to port 100

<figure><img src="https://1474932522-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FAgItg4KAZpnXjAFPWRf8%2Fuploads%2FTbr1WNyd22KMkryfLRl0%2FScreenshot%20from%202023-07-25%2015-15-03.png?alt=media&#x26;token=a2a41dd6-753a-4b93-948f-3aad9912ed72" alt=""><figcaption></figcaption></figure>

```
R1(config-std-nacl)# deny tcp any host 1.1.1.1 eq 80
```

* Deny all packets destinated for IP address 1.1.1.1/32, TCP port 80

{% hint style="info" %}
After the destination IP address and/or destination port numbers, there are many more options you can use to match (not necessary for the CCNA).

* **ack:** match the TCP ACK flag.
* **fin:** match the TCP FIN flag.
* **syn:** match the TCP SYN flag.
* **ttl:** match packets with a specific TTL value.
* **dscp:** match packets with a specific DSCP value.
{% endhint %}

{% hint style="info" %}
If you specify the protocol, source IP, source port, destination IP, destination port, etc, a packet must match **all** of those values to match the ACL entry. Even if it matches all except one of the parameters, the packet won't match that entry of the ACL.
{% endhint %}

### Practice

<details>

<summary>Allow traffic from 10.0.0.0/16 to access the server at 2.2.2.2/32 using HTTPS</summary>

```
R1(config-ext-nacl)# permit tcp 10.0.0.0 0.0.255.255 2.2.2.2 0.0.0.0 eq 43
```

</details>

<details>

<summary>Prevent all host using source UDP port number from 20000 to 30000 from accessing the server ar 3.3.3.3/32</summary>

```
R1(config-ext-nacl)# deny udp any range 20000 30000 host 3.3.3.3
```

</details>

<details>

<summary>Allow hosts in 172.16.1.0/24 using a TCP source port greater than 9999 to access all TCP ports on server 4.4.4.4/32 except port 23.</summary>

```
R1(config-ext-nacl)# permit tcp 172.16.1.0 0.0.0.255 gt 9999 host 4.4.4.4 neq 23
```

</details>

<figure><img src="https://1474932522-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FAgItg4KAZpnXjAFPWRf8%2Fuploads%2F8g4TfWVymKIfUU4OSwII%2FScreenshot%20from%202023-07-25%2015-29-53.png?alt=media&#x26;token=fb7a9dd9-30ea-4f25-b08b-f7c67e3f1ea2" alt=""><figcaption></figcaption></figure>

### First requirement

<figure><img src="https://1474932522-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FAgItg4KAZpnXjAFPWRf8%2Fuploads%2FsHdpFUh6jZsHb4XAkhYm%2FScreenshot%20from%202023-07-25%2015-30-26.png?alt=media&#x26;token=569cb431-bea2-41e6-bac5-35d8c8bc342b" alt=""><figcaption></figcaption></figure>

{% hint style="info" %}
Extended ACLs should be applied as close to the **source as possible**, to limit how far the packets travel in the nwtwork before being denied.

(Standard ACLs are less specific, so if they are applied close to the source there is a risk of blocking more traffic than intended)
{% endhint %}

<figure><img src="https://1474932522-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FAgItg4KAZpnXjAFPWRf8%2Fuploads%2FkDk4CIrNBtJsNosGy7J9%2FScreenshot%20from%202023-07-25%2015-32-44.png?alt=media&#x26;token=bacffad0-61e7-4bec-b2bc-a36f0906ef73" alt=""><figcaption></figcaption></figure>

### Second requirement

<figure><img src="https://1474932522-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FAgItg4KAZpnXjAFPWRf8%2Fuploads%2FH9kAH1P7yy8hj1DUVKLp%2FScreenshot%20from%202023-07-25%2015-36-48.png?alt=media&#x26;token=0e9bc5a9-f225-49e2-a3e2-ce856f72cc40" alt=""><figcaption></figcaption></figure>

### Third requirement

<figure><img src="https://1474932522-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FAgItg4KAZpnXjAFPWRf8%2Fuploads%2FXoOCtpcnDQIclPESIYRU%2FScreenshot%20from%202023-07-25%2015-39-36.png?alt=media&#x26;token=2cfc9bd7-8732-455f-ad05-913d78085afd" alt=""><figcaption></figcaption></figure>

### All requirements

<figure><img src="https://1474932522-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FAgItg4KAZpnXjAFPWRf8%2Fuploads%2FP0dn1D7Pr2lxruLqWJGN%2FScreenshot%20from%202023-07-25%2015-39-54.png?alt=media&#x26;token=250f8e68-4a0b-4bc4-b2d6-cb184519d282" alt=""><figcaption></figcaption></figure>

Checking the configurations.

<figure><img src="https://1474932522-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FAgItg4KAZpnXjAFPWRf8%2Fuploads%2FY9hYup9qduaAokNubxdd%2FScreenshot%20from%202023-07-25%2015-40-39.png?alt=media&#x26;token=8f95ff78-8221-48dc-91b0-9fe1dd4a7a5f" alt=""><figcaption></figcaption></figure>
