Extended ACLs
Protocol, source, destination and port matching, named ACLs, direction and placement, and evidence-based verification.
Extended matching
Extended ACLs match protocol, source, destination and ports — the full 5-tuple. Numbered 100–199 and 2000–2699, or named. Because they can target precisely, place them close to the source to drop unwanted traffic early.
Extended ACL syntax
| Element | Example | Meaning |
|---|---|---|
| Action + protocol | permit tcp | tcp, udp, icmp, ip, or a protocol number |
| Source | 192.168.10.0 0.0.0.255 | Wildcard, host, or any |
| Destination | host 10.0.0.5 | Wildcard, host, or any |
| Port match | eq 443 / eq 80 / eq www (=80) | Operator: eq, gt, lt, neq, range |
| Established | established | TCP only: match packets with ACK/RST set (return traffic) |
Port operators apply to the preceding address: tcp any host 10.0.0.5 eq 443 means 'any source → 10.0.0.5 port 443'. Source ports are rarely matched in ACLs (clients use ephemeral ports) — match the destination port. established matches only packets with ACK or RST set — a flag check used to approximate return traffic; it does not inspect connection state, and ACL placement near source/destination is a design guideline, not a universal rule.
Protocol nuances
| Protocol | Matching note |
|---|---|
| TCP/UDP | Port operators available on source and destination |
| ICMP | No ports — match message types (echo, echo-reply, unreachable) or any |
| ip | Matches all IP traffic — broadest option |
| OSPF/EIGRP | Their own protocol numbers (89/88) — routing traffic is not 'ip' exempt |
Configuration
Allow web and DNS from the LAN, deny everything else to the server subnet — Privileged EXEC → Global + interface configuration
Cisco IOS / IOS XE
configure terminal ip access-list extended LAN-TO-SERVERS permit tcp 192.168.10.0 0.0.0.255 10.0.0.0 0.0.0.255 eq 443 permit tcp 192.168.10.0 0.0.0.255 10.0.0.0 0.0.0.255 eq 80 permit udp 192.168.10.0 0.0.0.255 host 10.0.0.53 eq domain deny ip any any log exit interface gigabitethernet0/2 ip access-group LAN-TO-SERVERS in end
show access-lists LAN-TO-SERVERS
- Match counters confirm which rules carry traffic.
- The logged deny reveals what the implicit deny would hide.
Changes device configuration.
- Rules
- 10 permit tcp 192.168.10.0 0.0.0.255 host 10.0.0.5 eq 443 20 deny ip any any
- Packets
- A: 192.168.10.5→10.0.0.5:443; B: 192.168.10.5→10.0.0.5:22; C: 10.9.9.9→10.0.0.5:443
- A matches rule 10 → permitted.
- B fails rule 10 (wrong port) → hits rule 20 → denied.
- C fails rule 10's source wildcard → denied by rule 20.
Every element of a rule must match — source, destination, protocol AND port.
Verification
Common mistakes
- Applying the port operator to the wrong side —
eq 443after the source matches the source port, not the destination's. - Using
establishedexpecting real statefulness — it's a flag check, not connection tracking. - Blocking ICMP entirely — path MTU and ping diagnostics break.
- Placing the extended ACL near the destination — wasted bandwidth carrying doomed traffic.
- Forgetting the implicit deny — same as standard ACLs.
Observation: Users can't reach https sites since the new ACL was applied inbound on the LAN interface.
- Return traffic blocked — permit matched outbound only
- Rule order — a deny precedes the web permit
- Wildcard covers the wrong range
| Check | Indicates |
|---|---|
show access-lists counters | Which line increments — the real evaluation path. |
| Is the filter applied on the wrong direction? | An inbound ACL on the LAN only sees packets entering the router — replies exit that interface and are not evaluated by it; any reverse-path filter must be defined separately. |
| Return-path filtering elsewhere | If replies fail, the block is on the exit path or a separate inbound filter on the far interface — not this LAN-inbound ACL. |
Correction: Reorder rules or add the return-traffic path (established/reflexive/firewall feature).
Permit counters rise on both directions and sessions complete.
On this page
Sources
- Cisco CCNA 200-301 v1.1 Exam Topics (official PDF) — reviewed 2026-11-02
- Cisco — IP Addressing Services Command Reference — reviewed 2026-11-02
Targets CCNA 200-301 v1.1 objectives. Supplemental blocks are labeled beyond exam scope.