TechKnowSurge

Cisco CCNA 5.6

VideoNetworkFree

Extended ACL

Extended ACLs offer greater traffic filtering precision than standard ACLs by allowing administrators to specify source and destination IP addresses, protocols, and port numbers in a single rule. Understanding their numbering ranges, command syntax, and optimal placement on the network is essential for effective access control.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

Extended ACLs provide a significantly more precise approach to network traffic filtering compared to standard ACLs. While standard ACLs filter traffic based solely on source IP address, extended ACLs require the specification of a protocol, a source IP address, a destination IP address, and a destination port or service, giving network administrators fine-grained control over exactly what traffic is permitted or denied and where it is allowed to go. Extended ACLs are identified by numbers in the ranges 100–199 or 2000–2699, distinguishing them from their standard counterparts. Placement strategy differs meaningfully between the two ACL types. Standard ACLs, because they reference only the source address, are placed as close to the destination as possible to avoid inadvertently blocking a host from reaching unintended parts of the network. Extended ACLs, because they can pinpoint both source and destination, are generally placed close to the traffic source so that unwanted packets are dropped immediately rather than consuming bandwidth by traveling across the network before being denied at the far end. In practice, however, strict adherence to the source-adjacent rule is not always the most secure approach. When a protected network segment can be reached from multiple VLANs or devices, applying individual ACLs to every possible ingress point is complex and error-prone. In those scenarios, placing the extended ACL directly on the interface adjacent to the resource being protected ensures consistent enforcement and reduces the risk of a misconfiguration leaving a path unguarded. Balancing the efficiency argument for source placement against the security argument for destination placement is a key consideration in real-world network design.

What you'll learn

Distinguish between standard and extended ACLs based on numbering ranges, command syntax, and filtering criteria including protocol, source IP, destination IP, and port
Determine the appropriate placement of extended ACLs on network interfaces relative to traffic source and destination to optimize performance and enforce security policy

What's covered

Extended ACLs

Numbering Ranges
- 100 through 199
- 2000 through 2699
Command Differences
- Protocol Required
- Source IP Address
- Destination IP Address
- Port or Service Specified
Placement Rules
- Extended ACL Near Source
- Standard ACL Near Destination
- Security Considerations
  - Avoid Multiple ACLs
  - Guard Specific Interface
Extended vs Standard ACL
- More Granular Control
- Reduces Unnecessary Traversal

Aligned to

Cisco CCNA

5.6 Configure and verify access control lists

Key terms

Access Control List: A set of rules that defines which users or systems are granted or denied access to a resource.
Standard ACL: An Access Control List that filters traffic based solely on the source IP address, using numbering ranges 1–99 and 1300–1999.
Extended ACL: An Access Control List that filters traffic based on source and destination IP addresses, protocol, and port numbers, using numbering ranges 100–199 and 2000–2699.
Packet Filtering: A firewall technique that inspects packets and allows or blocks them based on source, destination, and protocol.
Port: A logical endpoint for communication in a network, identified by a number that specifies a particular service or application.
Protocol: A set of rules governing the format and transmission of data between devices.

Transcript

Extended ACLs Versus Standard ACLs

We've talked about standard ACLs and actually applied them to some of our devices, but now let's get into the extended ACLs.

One of the first differences we see when it comes to standard ACLs versus extended ACLs is the numbering. With a standard ACL we have different numbers than what we would do with an extended ACL. An extended ACL is 100 through, or 2000 through 26.99. So those are the ranges. If the number falls into those ranges, then we're dealing with an extended ACL.

The command is going to look a little different. One thing it's going to require is the protocol, so it's going to require that you specify which protocol it is that you are going to be blocking or permitting. Another difference that we see is that not only do we have the source IP address, but we also have the destination IP address that we're referencing in here. And then finally we're going to put a protocol or a port at the end of this as well.

So that is the main difference: we can get more granular in both the source and destination IP and the source and destination service or port that we're referencing. Those are the big differences between an extended and a standard.

Where to Place the ACL

With a standard ACL the recommendation is to put it closest to the destination, and that's because it only specifies the source. If you put it too close to the source, then the source can't get anywhere on the rest of the network. So what we have to do for a standard ACL is put it closest to the destination, to block the traffic for whatever device you're trying to block the traffic from.

When it comes to an extended ACL, we can specify exactly what the destination is going to be. Because we can do that, there are some advantages to putting it closer to that source, and the advantage of that would be that it won't have to traverse the rest of the network just to find out that it's going to be blocked on the other side of the network.

That is the official answer: an extended ACL goes close to the source, versus a standard ACL goes close to the destination. Largely you want to follow that.

A Security Consideration

But there is one other thing to consider, and that is the security involved. If I'm trying to block traffic from getting to this network right here, I would have to put an ACL on every single VLAN there is, every single device that there is. I'd have to have a lot of different ACLs just to block traffic from getting to this network over here.

So from a security standpoint I like to sometimes put it in a little different location. In this case, if I'm trying to guard this network against resources that are over here, then what I'm going to do is put it on this interface right here, to make sure I get the security correct and make sure I don't miss some place along the path where I would need that ACL.

Read the full transcript Show less

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →