CCNA 200-301 v1.1 reference — Security Fundamentals
Extended ACLs
Protocol, source, destination and port matching, named ACLs, direction and placement, and evidence-based verification.
Objective 5.6v1.1 exam target
Loading
Extended ACLs match protocol, source, destination and ports — the full 5-tuple. Numbered 100–199 and 2000–2699, or named. Because they can target precisely, place them close to the source to drop unwanted traffic early.
Extended ACL syntax
| Element | Example | Meaning |
|---|---|---|
| Action + protocol | permit tcp | tcp, udp, icmp, ip, or a protocol number |
| Source | 192.168.10.0 0.0.0.255 | Wildcard, host, or any |
| Destination | host 10.0.0.5 | Wildcard, host, or any |
| Port match | eq 443 / eq 80 / eq www (=80) | Operator: eq, gt, lt, neq, range |
| Established | established | TCP only: match packets with ACK/RST set (return traffic) |
Extended ACL
Allow web and DNS from the LAN, deny everything else to the server subnet — Privileged EXEC → Global + interface configuration
Cisco IOS / IOS XE
configure terminal ip access-list extended LAN-TO-SERVERS permit tcp 192.168.10.0 0.0.0.255 10.0.0.0 0.0.0.255 eq 443 permit tcp 192.168.10.0 0.0.0.255 10.0.0.0 0.0.0.255 eq 80 permit udp 192.168.10.0 0.0.0.255 host 10.0.0.53 eq domain deny ip any any log exit interface gigabitethernet0/2 ip access-group LAN-TO-SERVERS in end
Verify
show access-lists LAN-TO-SERVERS
- Match counters confirm which rules carry traffic.
- The logged deny reveals what the implicit deny would hide.
Changes device configuration.
Predict the evaluation
- Rules
- 10 permit tcp 192.168.10.0 0.0.0.255 host 10.0.0.5 eq 443 20 deny ip any any
- Packets
- A: 192.168.10.5→10.0.0.5:443; B: 192.168.10.5→10.0.0.5:22; C: 10.9.9.9→10.0.0.5:443
- A matches rule 10 → permitted.
- B fails rule 10 (wrong port) → hits rule 20 → denied.
- C fails rule 10's source wildcard → denied by rule 20.
Every element of a rule must match — source, destination, protocol AND port.
Sources
- Cisco CCNA 200-301 v1.1 Exam Topics (official PDF) — reviewed 2026-11-02
- Cisco — IP Addressing Services Command Reference — reviewed 2026-11-02
Targets CCNA 200-301 v1.1 objectives. Supplemental blocks are labeled beyond exam scope.