PlantUML DiagramExtended ACL Placement
A structured lesson workspace with readable content, hands-on examples, and a clean path to completion.
! Extended ACL syntaxaccess-list 100 permit tcp 10.10.20.0 0.0.0.255 host 10.10.99.10 eq 443access-list 100 permit tcp 10.10.20.0 0.0.0.255 host 10.10.99.10 eq 22access-list 100 permit icmp 10.10.20.0 0.0.0.255 host 10.10.99.10 echoaccess-list 100 deny ip any any log! Apply close to the sourceinterface gigabitEthernet0/1ip access-group 100 in! Verifyshow access-lists 100
This extended ACL allows the IT subnet to reach a specific server on HTTPS (443), SSH (22), and ICMP echo — nothing else. The extended syntax gets specific: source, destination, protocol, and port. The result is a precise policy instead of the blunt instrument that standard ACLs provide.
| Component | Examples | Notes |
|---|---|---|
| Action | `permit`, `deny` | Required at the start |
| Protocol | `ip`, `tcp`, `udp`, `icmp`, `gre`, `esp` | `ip` matches all |
| Source | `host X.X.X.X` / `X.X.X.X W.W.W.W` / `any` | Wildcard for networks |
| Destination | Same as source | Required for extended |
| Port (TCP/UDP only) | `eq 80`, `gt 1023`, `range 1 1024` | `eq` = equal, `gt` = greater than |
| Flags | `established`, `syn`, `ack`, `fin` | `established` matches return traffic |
That `established` keyword deserves attention. It matches TCP packets with the ACK or RST flag set — the flag pattern of return traffic in an established connection. If you permit outbound TCP and deny inbound, adding `established` on the inbound rule allows the return traffic through without opening a hole for inbound-initiated connections.
The `established` keyword is a crude form of stateful filtering. It can be spoofed by an attacker who sets the ACK flag on the first packet. Real stateful firewalls track full connection state, not just flags. But for basic IOS router ACLs, `established` is the standard tool and stops casual port scans.
Because extended ACLs can distinguish 'traffic to X' from 'traffic to Y,' placing them near the source doesn't break unrelated flows. The unwanted traffic is dropped at the ingress router before it consumes bandwidth on intermediate links. This is the opposite of standard ACL placement, and it's an exam favorite.
Create an extended ACL that allows 10.10.10.0/24 to reach any web server on ports 80 and 443, denies Telnet (23) to everything with logging, and permits all other traffic. Apply it inbound on the user-facing interface.
Extended ACLs are the workhorse of Cisco traffic filtering. Match on source, destination, protocol, and port. Place near the source. Use `established` for return traffic. Next lesson covers named ACLs and placement strategy.
Finish the lesson once you have worked through the material. This awards ★ 15 XP.