Mastering Extended ACLs for the CCNA Exam

Extended ACLs provide precise traffic filtering by examining source/destination IPs, protocols (TCP/UDP/ICMP), and port numbers, and should be placed close to the source.

The Power of Extended ACLs

Unlike Standard ACLs, **Extended ACLs** offer high granularity. They can inspect the protocol layer (such as TCP, UDP, ICMP), the source and destination IP addresses, and the specific Layer 4 port numbers (like Port 80 for HTTP or 443 for HTTPS). This allows administrators to implement very specific security policies. Extended ACLs use the numbering ranges 100 to 199 and 2000 to 2699.

Extended ACL Placement

The general best practice is to place **Extended ACLs as close to the source as possible**. Because they are highly specific and check both the destination and the port, dropping unwanted packets early saves network bandwidth. There's no risk of accidentally blocking traffic to other legitimate destinations if configured correctly.

Syntax and Configuration

Extended ACL configuration requires defining the protocol and both source and destination endpoints.

* `Router(config)# access-list 101 deny tcp host 10.1.1.5 host 192.168.2.10 eq 80` * `Router(config)# access-list 101 permit ip any any`

This configuration drops HTTP (port 80) traffic from 10.1.1.5 to 192.168.2.10, while allowing all other IP traffic.

❓ Frequently Asked Questions