TechKnowSurge
Cisco CCNA 5.6 Cisco CCNA 2.1
TechKnowSurge Catalog Videos DEMO: Extended Named ACLs
VideoNetworkFree

DEMO: Extended Named ACLs

Extended named ACLs offer a flexible way to control network traffic by combining descriptive naming with granular permit and deny rules applied directly to VLAN interfaces.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

Extended named access control lists provide a method for filtering network traffic with both precision and readability. Unlike numbered ACLs, where the numeric range implicitly identifies the list as standard or extended, named ACLs require the type to be declared explicitly during configuration. The ip access-list extended command followed by a descriptive name creates the list and enters ACL configuration mode, where permit and deny statements define which traffic is allowed or blocked based on criteria such as source IP address, destination, and protocol. Once the ACL rules are defined, the list is applied to a VLAN interface using the ip access-group command with the inbound or outbound direction specified. Traffic matching a permit statement is forwarded, while traffic reaching an implicit or explicit deny is dropped. In a practical example, permitting traffic from specific source addresses while denying others on the same subnet results in only the permitted hosts maintaining connectivity through the interface, confirming the ACL is enforcing policy as intended. Removing or modifying an extended named ACL follows a straightforward process. Individual rules can be negated using the no keyword before the original statement, the ACL can be detached from an interface by prepending no to the ip access-group command, and the entire named ACL can be deleted from the device configuration. This flexibility makes named ACLs easier to manage and audit compared to their numbered counterparts, particularly in environments where multiple access policies are maintained across different interfaces and VLANs.

What you'll learn

What's covered

Extended Named ACL

Aligned to

Cisco CCNA
5.6 Configure and verify access control lists
2.1 Configure and verify VLANs (normal range) spanning multiple switches

Key terms

Access Control List
ACL
A set of rules that defines which users or systems are granted or denied access to a resource.
Virtual LAN
VLAN
A logical grouping of network devices that behave as if they are on the same network regardless of physical location.
IP Address
A numerical label assigned to each device connected to a network that uses the Internet Protocol.
Named Extended ACL
A Cisco IOS access control list identified by a descriptive name rather than a number, configured with the 'ip access-list extended' command and capable of filtering traffic based on source, destination, protocol, and port.
VLAN Interface
A logical Layer 3 interface on a switch associated with a specific VLAN, commonly used as a management interface or default gateway.
Global Configuration Mode
A Cisco IOS CLI sub-mode entered from Privileged EXEC Mode using the configure terminal command, indicated by (config)# in the prompt, where device-wide configuration changes are made.

Transcript

This is my network right here. I'm on the demo laptop, and the demo laptop has three IP addresses that are assigned to it on the speedlan 10: one ending in .34, one in .35, and one in .244. What I'm doing down here in the bottom side is, from each of those IP addresses I'm pinging the switch over here, and you can see that I'm getting replies from all of them.

So what I'm going to do is a named extended access list, and we're going to program it and actually apply it to VLAN 10.

Building the named extended ACL

Let's jump on our switch here. I'm going to get into the global configuration mode and I'm going to type in ip access-list. One of the differences here is, notice that the IP is at the front of this, so for a named access list I put an IP at the front of this. The next one I'm going to do is, since it's not numbered, a number gives away whether it's a standard or extended, so since it's not numbered I have to put extended in here.

Let's do a question mark. I just want to show you something: I actually can still put a number in here, so I still can turn this into a numbered access list. But what I want to do is give this a name, so I'm just going to call it my ACL. That's an amazing name for this.

We're now editing the ACL, so I'm going to allow traffic from the demo laptop. Actually all of the rest of this is pretty much the same that we have been working with, that I worked with before, so I'm just going to copy this. I'm going to put that all into play.

Applying it to the interface

The next thing I'm going to do is get into interface VLAN 10, and then I want ip access-group my ACL and N. I'm going to paste that into there and we'll hit enter. I no longer can ping from the 244, and that's because I am denying anything from that network after I already permitted from the .34 and the .35. So this is behaving as I would expect.

Backing out the changes

Now what if I want to back out the changes? I'll just put a no in front of these same statements. I can back out the one applied to the interface, and then I can also back out the ACLs and take the ACL off. And there we have it, so changes are backed out.

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →