TechKnowSurge

Cisco CCNA 5.6

VideoNetworkFree

DEMO: Extended Numbered ACLs

Extended numbered ACLs allow granular traffic filtering by source, destination, and protocol, and should be applied as close to the traffic source as possible. This content covers building and applying an extended ACL on a Layer 3 switch virtual interface to selectively permit and deny traffic across VLANs.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

Extended numbered ACLs give network engineers fine-grained control over traffic flow by matching on both source and destination addresses as well as specific Layer 3 and Layer 4 protocols. Because they support such specific matching criteria, best practice dictates placing them as close to the traffic source as possible to avoid unnecessarily consuming bandwidth across the network. In this scenario, ACL 142 is built directly on the switch serving VLAN 10 and applied inbound on its switch virtual interface, ensuring that traffic is filtered at the earliest point of entry. Remark statements are used throughout the ACL to document the intent of each rule, which is a recommended practice for maintainability in production environments. The ACL is structured to first permit all IP traffic from a designated primary host, ensuring that critical management connectivity is preserved. Subsequent rules permit ICMP from a second host address and allow TCP port 22 from that same address toward a specific destination, illustrating how both protocol type and port number can be specified in a single extended ACL entry. A deny statement then blocks all remaining traffic originating from the 10.1.10.0 network from reaching the 10.2.0.0 network, followed by a final permit any rule to pass all other traffic. Once the ACL is applied to the interface with the correct access-group command, the results are immediately visible: hosts explicitly permitted continue to reach their destinations, while traffic from unlisted addresses in the VLAN is dropped as intended.

What you'll learn

Configure a numbered extended ACL on a Cisco switch to permit and deny specific IP, ICMP, and TCP traffic by source host and destination network
Apply an extended ACL to a switch virtual interface (SVI) in the inbound direction to enforce traffic filtering closest to the source

What's covered

Extended Numbered ACLs

ACL Placement Strategy
- Closest to Source
- Applied to VLAN 10 SVI
ACL Configuration Commands
- Remark Statements
- Permit Host IP Any
  - Host 10.1.10.34 Allowed
- Permit ICMP and TCP
  - Host 10.1.10.35 Ping
  - TCP Port 22 SSH
- Deny VLAN 10 to 10.2.0.0
- Permit All Other Traffic
Applying ACL to Interface
- Interface VLAN 10
- IP Access Group Inbound
- ACL Number 142
Verifying ACL Behavior
- Dot 244 Traffic Blocked
- Dot 34 and 35 Permitted

Aligned to

Cisco CCNA

5.6 Configure and verify access control lists

Key terms

Access Control List: A set of rules that defines which users or systems are granted or denied access to a resource.
Internet Control Message Protocol: A network layer protocol used to send error messages and operational information about network conditions.
Transmission Control Protocol: A connection-oriented transport protocol that ensures reliable, ordered, and error-checked delivery of data.
Internet Protocol: The principal communications protocol for routing packets across network boundaries.
Virtual LAN: A logical grouping of network devices that behave as if they are on the same network regardless of physical location.
Ingress Filtering: The practice of monitoring and restricting inbound network traffic based on security policies.
Switch Virtual Interface: A virtual layer 3 interface on a switch associated with a VLAN. On a layer 2 switch a single SVI provides the management IP address; on a layer 3 switch, SVIs also route between VLANs.

Transcript

Let's get into the commands for extended numbered ACLs.

This is my network. What I want to do is filter some of the traffic coming from this 10.1.10.0 network, that is VLAN 10. Since this is going to be an extended ACL I want to put it closest to the source, so I'm going to put it on this switch. This is VLAN 10, so I'm going to put it on the switch virtual interface of VLAN 10, since that is closest to the source.

I'm on this demo laptop right here. This demo laptop has three IP addresses, 10.1.10.34, .35 and .244, and as you can see I'm pinging out to that switch on the other side.

Entering the commands

Let's jump into the commands that we're going to enter in here. I'm going to pull up switch 1, and the first command is just a remark telling me what the next command is going to be. I'll copy that. I do have to get into global configuration mode, so I'm going to paste this: access list 142, and it's just a remark, so I'm going to hit enter there.

The next step is I want to permit anything coming from the host. So it's permitting IP — the protocol is IP, so it's layer 3, this is talking about any IP protocols that are happening — it's going to permit, and then it's going to be host 10.1.10.34, so that's this first ping that's happening right here, and to any of the other devices. One reason why I want to do this is because my demo laptop is pretty critical, it's remoted into all of these other machines, and I don't want it to disconnect from everything. This just makes sure this demo laptop can hit everything from its primary IP address.

Next we have another remark statement saying what the next two commands are going to do. I'm going to be allowing ICMP, so ICMP is my ping traffic that's happening — that's this middle ping that's happening, so we should see that still live because it's permitting that.

I'm also putting in the permit TCP host 10.1.10.35 to that switch over there on the other side, so I'm specifying the host IP address and the equivalent to 22, so this is SSH right here. I'm not going to be doing anything with that SSH traffic that's there, but I wanted to put in some sort of TCP traffic in there so you could see that. I'm going to paste this into there.

Next I have another remark telling what the next item is going to do, and essentially what it's doing is denying the rest of the traffic — anything else on that VLAN 10 will not be able to get to the 10.2.0.0 network, so it's going to deny all of the traffic from that network. I'll paste that in there. And finally I'm going to permit all other traffic, and we need to specify IP there, so I'll make that change on here as well.

Applying it to the interface

Next we need to apply this to the interface. We're going to be applying it to interface VLAN 10, which is what that network is on, and it's going to be all the traffic coming into it. So let's do an IP access list 142 in and we'll paste it right there. What we need is access group — I had a typo there, so let's change that to group and hit enter there.

Now as soon as it applies you can see that my pings are no longer making it to that switch on the other side from the .244. That's because I've blocked all the rest of the traffic from there. But where I permitted traffic, which was from the .34 and the .35, that is still being allowed. So we've implemented this access list.

Read the full transcript Show less

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →