Cisco Systems CCNA 2 manual Extended ACLs, Rt1config#access-list 101 ?

Match only packets with a lower port number Match only packets not on a given port number

11.2.2 Extended ACLs

Extended ACLs are used more often than standard ACLs because they provide a greater range of control. Extended ACLs check the source and destination packet addresses and also check for protocols and port numbers. This provides greater flexibility to define what the ACL will filter. Packets can be permitted or denied access based on where the packet originated and its destination or protocol types and port addresses. For a single ACL, multiple statements may be configured. The syntax for the extended ACL statement can get very long and will often wrap in the terminal window. The wildcards also have the option of using the host or any keywords in the command.

The extended ACL uses the source and destination address. Ask students what ports are used for FTP, Telnet, SMTP, HTTP, and DNS. The students need to have these ports memorized. The first part of the IP extended ACL is the same as the IP standard ACL. The number is within the range of 100 to 199.

rt1(config)#access-list 101 ?

deny	Specify	packets to	reject
dynamic	Specify a DYNAMIC		list of PERMITs or DENYs
permit	Specify packets to forward
remark	Access	list entry	comment

The permit or deny is the same as the standard.

rt1(config)#access-list 101 permit ?

<0-255> An IP protocol number

ahp	Authentication Header Protocol
eigrp	Cisco's EIGRP routing protocol
esp	Encapsulation Security Payload
gre	Cisco's GRE tunneling
icmp	Internet Control Message Protocol
igmp	Internet Gateway Message Protocol
igrp	Cisco's IGRP routing protocol
ip	Any Internet Protocol
ipinip	IP in IP tunneling
nos	KA9Q NOS compatible IP over IP tunneling
ospf	OSPF routing protocol
pcp	Payload Compression Protocol
pim	Protocol Independent Multicast
tcp	Transmission Control Protocol
udp	User Datagram Protocol

In an extended ACL, the protocol is listed after the permit or deny statement. Then enter the source address with the wildcard mask and destination address with the wildcard mask.

rt1(config)#access-list 101 permit tcp 172.16.0.1 0.0.0.0 192.168.0.0 0.0.255.255 ?

ack	Match on the ACK bit
eq	Match only packets on a given port number
established Match established connections
fin	Match on the FIN bit
gt	Match only packets with a greater port number
log	Log matches against this entry

log-input Log matches against this entry, including input interface

lt neq

125 - 238 CCNA 2: Routers and Routing Basics v3.1 Instructor Guide – Module 11 Copyright ♥ 2004, Cisco Systems, Inc.