|
Extended ACLs are used more often than
standard ACLs because they provide a greater range of control.
 Extended
ACLs check the source and destination packet addresses as well as
being able to check for protocols and port numbers. This gives greater
flexibility to describe what the ACL will check. Packets can be
permitted or denied access based on where the packet originated and
its destination as well as protocol type and port addresses. An
extended ACL can allow e-mail traffic from Fa0/0 to specific S0/0
destinations, while denying file transfers and web browsing. When
packets are discarded, some protocols send an echo packet to the
sender, stating that the destination was unreachable.For a single ACL, multiple statements
may be configured.
 Each of
these statements should contain the same access-list-number, to relate
the statements to the same ACL. There can be as many condition
statements as needed, limited only by the available router memory. Of
course, the more statements there are, the more difficult it will be
to comprehend and manage the ACL.
The syntax for the extended ACL
statement can get very long and often will wrap in the terminal
window. The wildcards also have the option of using the host or
any keywords in the command.
At the end of the extended ACL
statement, additional precision is gained from a field that specifies
the optional Transmission Control Protocol (TCP) or User Datagram
Protocol (UDP) port number.
 The
well-known port numbers for TCP/IP are shown in Figure
 . Logical
operations may be specified such as, equal (eq), not equal (neq),
greater than (gt), and less than (lt), that the extended ACL will
perform on specific protocols. Extended ACLs use an access-list-number
in the range 100 to 199 (also from 2000 to 2699 in recent IOS).
The
ip access-group
command links an existing extended ACL to an interface. Remember that
only one ACL per interface, per direction, per protocol is allowed.
The format of the command is:
Router(config-if)#ip
access-group access-list-number {in | out}
| |
Lab Activity
Lab Exercise: Configuring Extended Access Lists
This lab is to configure, and apply an
extended ACL to permit or deny specific traffic.
|
|
|
| |
Lab Activity
Lab Exercise: Simple Extended Access Lists
This lab is to configure, and apply
extended access lists to filter network to network, host to
network, and network to host traffic.
|
|
|
| |
Lab Activity
e-Lab Activity: Configuring an Extended Access List
In this lab, the student will plan, configure, and apply and
extended ACL to permit or deny specific traffic and test the ACL
to determine if the desired results were achieved.
|
|
| |
Lab Activity
e-Lab Activity: Extended ACL
In this lab, the students will configure an extended
access-control list for the local router "Mexico".
|
|
| |
Lab Activity
e-Lab Activity: Extended ACL's
In this lab, the students will configure an extended
access-control list for the local router "Jakarta".
|
|
| |
Lab Activity
e-Lab Activity: Extended ACL
In this lab, the students will configure an extended
access-control list for the local router "Kuwait".
|
|
| |
Lab Activity
e-Lab Activity: Extended ACL
In this lab, the students will configure an extended
access-control list for the local router "Abuja".
|
|
|
Web Links