An extended named ACL is a named access control list that filters packets using protocol, source address, and destination address, with optional port conditions. Each access control entry (ACE) permits or denies matching traffic; every specified condition must match. section 24.1.1 section 23.4
Use these matching choices when writing an ACE:
- Specify icmp, tcp, udp, ospf, or ip; ip matches all IPv4 protocols. section 24.1.1
- Use any for every address, host ip-addr for one address, or an address with a wildcard mask for a range. section 24.1.1
- Apply the ACL close to the traffic source, then remember that ACEs process top-to-bottom and unmatched packets meet implicit deny. section 23.4 section 24.4
Representative configuration
Create the ACL with ip access-list extended TEST1, then enter ACEs such as permit icmp host 172.16.1.1 192.168.3.0 0.0.0.255 or deny udp any any. Named ACL configuration supports optional sequence numbers. section 24.1.1
R1(config)# ip access-list extended {name | number}
R1(config-ext-nacl)# [seq-num] {permit | deny} protocol source destination
Open the Cisco IOS syntax for creating an extended named ACL and entering its ACEs. section 24.1.1
