An extended numbered access control list (ACL) filters packets using protocol, source IP address, destination IP address, and—when TCP or UDP is selected—port conditions. Its identifier must be in the range 100–199 or 2000–2699. Unlike a standard ACL, it can distinguish traffic by both endpoints and protocol. section 24.1.1 section 24.4
Build each access control entry (ACE) from matching conditions:
- Choose a protocol such as icmp, tcp, udp, or ospf; use ip to match any IPv4 payload. section 24.1.1
- Specify source and destination addresses with any, host ip-addr, or an IP address followed by a wildcard mask. section 24.1.1
- Remember that every specified condition must match, and that ACEs are evaluated from top to bottom until one matches. section 24.1.1 section 23.4
- Apply extended ACLs close to the traffic source, and account for the implicit deny when no explicit ACE matches. section 24.4 section 23.4
Example ACEs
permit ip any any allows all IPv4 traffic. deny udp 10.0.0.0 0.0.0.255 192.168.1.0 0.0.0.255 blocks UDP traffic from 10.0.0.0/24 to 192.168.1.0/24. deny icmp any 203.0.113.0 0.0.0.255 blocks ping traffic to that network. permit ip host 172.16.1.1 any permits all IPv4 traffic from one host. section 24.1.1
Use the command template to create a numbered ACE in global configuration mode: access-list number {permit | deny} protocol source destination. section 24.1.1
