- [Narrator] I always utilized extended ACLs when possible.
They offer more flexibility as they can match
more portions of the packet header,
which means greater granularity.
Extended ACLs configure similarly to standard ACLs,
at least at first.
Their number ranges are from 100 to 199 and 2000 to 2699.
The command structure begins access list number
perimeter nine, then it changes.
After this a protocol is specified
like TCP, UDP, ICMP or IP.
Next, is source address and wildcard masks
then destination and wildcard masks.
An extended ACL entry that will allow any ICMP
would be config t, access list 101 permit icmp any any.
Here, I specified the ACL command,
then the number, permit to allow, ICMP is the protocol type,
then any source and any destination.
If I also wanted to deny any UDP,
it would be access list 101 deny UDP any to any.
I could be more specific with addressing like
access list 101 deny UDP host 192.168.1.1
to network 10.0.0.0.0.0.0.255.
This will filter 192.168.1.1
from getting anything 10. on UDP.
Keep in mind that all parts of a line must be matched
for the packet to be filtered on that individual line.
Now for the fun stuff.
Extended ACLs allow for matching
of ports and TCP and UDP packets.
It has a logic for equal to, not equal to,
less than, greater than, or a range of ports.
The ACL starts very similarly again.
Access list, number, permit, now I choose TCP or UDP.
Then the source addressing is specified.
After that it depends on if I need to match
on source ports, destination ports or both.
Examples tend to make things a bit simpler.
I'll create an entry that will match
and drop TCP traffic sourced from port 80.
Access list 105 deny TCP anyone
equal to port 8000 going to anyone.
Now, I'll match anything destined
to UDP port over 3000 and drop it.
Access list 105 deny UDP anything to anywhere
destined to port greater than 3000.
Now we'll block a specific host going to a subnet source
going from TCP port 90 to TCP port 8585.
Access list 105 deny TCP host 100.64.0.2
equal to port, source port that is,
90 going to destination network 192.168.0.0.0.0.0.255
equal to destination port 8585.
It's also an option to use not only decimals
for port numbers but also key words
can be used for well known ports like SSH or WWW.
Extended ACLs are used constantly
because they have so much power
being able to not only use source and destination networks,
but also the individual port or protocol.