Extended ACLs

Extended ACLs are a type of access control list that filters IP packets based on multiple criteria: source IP address, destination IP address, protocol (IP, TCP, UDP, ICMP, etc.), and optionally source and destination port numbers. They are used to implement security policies, control traffic flow, and protect network resources. Extended ACLs are more granular than standard ACLs, which only filter on source IP.

Extended ACLs are identified by numbers 100-199 and 2000-2699 (modern range) or named ACLs. The Cisco CCNA 200-301 exam expects you to configure numbered extended ACLs (100-199) and named extended ACLs.

When a packet enters or exits an interface, the router checks the ACL applied to that interface in the given direction. The ACL is a sequential list of permit or deny statements. The router evaluates the packet against each statement in order; as soon as a match is found, the action (permit/deny) is executed and no further statements are processed. If no match is found, the implicit deny any denies the packet.

Extended ACLs can check:

Extended ACLs are configured in global configuration mode. The syntax:

access-list [100-199 | 2000-2699] [permit | deny] protocol source-ip source-wildcard [operator port] destination-ip destination-wildcard [operator port] [established] [log]

For named ACLs:

ip access-list extended name
[permit | deny] protocol source-ip source-wildcard [operator port] destination-ip destination-wildcard [operator port] [established] [log]

Example: Allow HTTP traffic from any source to server 192.168.1.10, deny all other traffic:

access-list 101 permit tcp any host 192.168.1.10 eq 80
access-list 101 deny ip any any

Note: The host keyword means a specific IP (wildcard 0.0.0.0). any means 0.0.0.0 255.255.255.255.

ACLs must be applied to an interface in a specific direction (in or out) using the ip access-group command:

interface GigabitEthernet0/0
 ip access-group 101 in

Direction is from the perspective of the router: "in" means packets entering the interface, "out" means packets leaving the interface.

Use show access-lists to view all ACLs:

Router# show access-lists
Extended IP access list 101
    10 permit tcp any host 192.168.1.10 eq 80 (12 matches)
    20 deny ip any any (5 matches)

The match count shows how many packets matched each line.

Use show ip interface [interface] to see which ACLs are applied:

Router# show ip interface GigabitEthernet0/0
...
  Inbound access list is 101
  Outbound access list is not set

Place extended ACLs as close to the source as possible to filter traffic early, reducing unnecessary traffic across the network. Standard ACLs are placed close to the destination because they only check source IP. Extended ACLs can check destination, so they are effective near the source.

Every ACL ends with an implicit deny ip any any. This is not shown in the configuration but is always present. Sequence numbers (like 10, 20) are automatically assigned and can be used to insert or delete lines.

Extended ACLs can be used with:

Named ACLs allow easier management. Example:

ip access-list extended BLOCK_SMTP
 deny tcp any any eq 25
 permit ip any any

Then apply:

interface GigabitEthernet0/1
 ip access-group BLOCK_SMTP in

Named ACLs can be edited by sequence number, e.g., 10 deny tcp any any eq 25 can be removed with no 10.

The established keyword matches TCP packets that have the ACK or RST bit set, indicating an established connection. This is used to allow return traffic for outbound connections while blocking inbound new connections. Example:

access-list 102 permit tcp any any established

This allows return traffic for TCP sessions initiated from inside. Note: This is not stateful; it only checks bits. For stateful inspection, use a firewall.

In a typical enterprise, extended ACLs are used to enforce security policies at network boundaries. For example, at the internet edge, an extended ACL on the outside interface (inbound) permits only specific services (HTTP, HTTPS, SMTP) to the public servers and denies everything else. This protects internal infrastructure from unsolicited inbound traffic. A common configuration is:

access-list 101 permit tcp any host 203.0.113.10 eq 80
access-list 101 permit tcp any host 203.0.113.10 eq 443
access-list 101 permit tcp any host 203.0.113.11 eq 25
access-list 101 deny ip any any log

Then applied inbound on the internet-facing interface. The log keyword helps identify scanning attempts.

Another scenario is segmenting internal networks. For instance, the finance department (10.1.1.0/24) should only access the finance server (10.2.2.10) on port 3306 (MySQL). An extended ACL on the finance server's interface (inbound) permits only that traffic:

access-list 120 permit tcp 10.1.1.0 0.0.0.255 host 10.2.2.10 eq 3306
access-list 120 deny ip any any log

This prevents other users from reaching the finance server.

Performance considerations: ACLs are processed in hardware (Cisco Express Forwarding) for most platforms, but large ACLs with many entries can consume TCAM resources. Typically, keep ACLs under a few hundred entries. Misconfiguration can cause outages: applying an ACL with only permit statements will implicitly deny all other traffic, potentially blocking critical services like DHCP or routing protocols. Always test ACLs in a lab or during maintenance windows. Use show access-lists to monitor match counts and ensure traffic is being permitted/denied as expected.