An extended access control list (ACL) filters IPv4 packets using several attributes, making it more precise than a standard ACL. It can match the payload protocol, source and destination IP addresses, and TCP or UDP ports. A packet must match every condition in an access control entry (ACE) for that entry to apply. section 24.0 section 24.1.1
Use these rules when designing and applying an extended ACL:
- Process ACEs from top to bottom; place more specific permits or denies before broader rules. Unmatched traffic is discarded by the implicit deny. section 24.0
- Select a protocol such as icmp, tcp, udp, or ospf, or use ip to match any IPv4 payload protocol. section 24.1.1
- Specify addresses with any, host ip-address, or an IP address plus wildcard mask. Extended ACLs require host or a wildcard mask for a single address. section 24.1.1
- For TCP or UDP, match source or destination ports with operators such as eq, gt, lt, neq, or range. Client HTTP traffic normally uses destination port 80. section 24.2 section 24.4
- Apply the ACL to an interface in the inbound or outbound direction; creation alone does not affect forwarding. Extended ACLs are generally placed close to the source. section 23.4 section 24.4
Use numbered syntax to create an extended ACL directly in global configuration mode. section 24.1.1
R1(config)# ip access-list extended {name | number}
R1(config-ext-nacl)# [seq-num] {permit | deny} protocol source destination
Use named ACL configuration mode when assigning readable names and optionally sequencing ACEs. section 24.1.1
Blocking HTTP from an engineering LAN
A named ACL can deny TCP traffic from 192.168.1.0/24 to Server LANs 192.168.3.0/24 and 192.168.4.0/24 when the destination port equals 80, then permit all other IPv4 traffic: R1(config)# ip access-list extended NO_HTTP R1(config-ext-nacl)# deny tcp 192.168.1.0 0.0.0.255 192.168.3.0 0.0.0.255 eq 80 R1(config-ext-nacl)# deny tcp 192.168.1.0 0.0.0.255 192.168.4.0 0.0.0.255 eq 80 R1(config-ext-nacl)# permit ip any any R1(config)# interface g0/0 R1(config-if)# ip access-group NO_HTTP in The final permit prevents the implicit deny from blocking unrelated traffic. section 24.2
