ACLs filter packets by Layer 3/4 information. Standard ACLs match source IP only and live close to the destination. Extended ACLs match source, destination, protocol, and port — and live close to the source. This chapter walks through both with worked examples.
Numbers 1–99 (and 1300–1999) are standard ACLs. They match only on source IP. Apply outbound on the interface closest to the destination so legitimate traffic is allowed elsewhere first.
R1(config)# access-list 10 permit 10.0.10.0 0.0.0.255
R1(config)# access-list 10 deny 10.0.20.0 0.0.0.255
R1(config)# access-list 10 permit any
R1(config)# interface Gi0/1
R1(config-if)# ip access-group 10 outNumbers 100–199 (and 2000–2699) — or named — are extended. Match source, destination, protocol, and port. Apply inbound on the interface closest to the source so unwanted traffic dies before it consumes router resources.
R1(config)# ip access-list extended WEB-IN
R1(config-ext-nacl)# permit tcp 10.0.0.0 0.0.255.255 host 10.0.99.10 eq 80
R1(config-ext-nacl)# permit tcp 10.0.0.0 0.0.255.255 host 10.0.99.10 eq 443
R1(config-ext-nacl)# deny ip any any log
R1(config-ext-nacl)# exit
R1(config)# interface Gi0/0
R1(config-if)# ip access-group WEB-IN in1 more section in this chapter, plus a 3-question quiz and a hands-on lab.
You can see the title, summary, learning objectives and the opening sections. The rest of this chapter, like all of modules 2–8, comes with the Course & Lab Pass and All-Access Max. A free account opens Module 1: Network Foundations end-to-end and saves your labs — start there, no card required.
NetForge-AI is an independent educational platform and is not affiliated with, endorsed by, or sponsored by any networking vendor or certification body. All product names, protocols, and standards referenced are the property of their respective owners and are used for descriptive, educational purposes only.
Free account · no card required · compare plans any time