Cisco CCNA Standard versus Extended Access List


Standard access lists

These use only the source IP address in an IP packet as the condition test.  All decisions are made based on source IP address.  This means that standard access lists basically permit or deny an entire suite of protocols. They don’t distinguish between any of the many types of IP traffic such as WWW, telnet, UDP, etc.

Extended access lists

Extended access lists can evaluate many of the other fields in the layer 3 and layer 4 header of an IP packet.

IP Source Address

IP Destination Address

Protocol Field in Network Layer Packet

Port number in Transport Layer Segment

Cisco CCNA Extended Access List Example


This slide shows an example of an extended IP access list.

It denies FTP (port 21 is FTP and port 20 is FTP data) from subnet to  Actually since there is an implicit DENY at the end of each access list, this access list denies all packets since there is NOT a permit statement.  Note: If access list 101 were applied to an interface, all traffic either inbound or outbound (depending on how the ACL was applied) would be denied.

As a general rule, all ACLs should have at least 1 permit rule.

Cisco CCNA Extended Access List Example


Taking the previous example a little further, it the intent of the ACL is to deny FTP from to but permit all other traffic then the following permit statement needs to be added after the deny statements:

access-list 101 permit ip any any

 Access list 101 could be applied inbound to interface Fa0/1 or outbound to interface Fa0/0.

Remember there is an implicit deny ip any any at the end of every ACL.

Cisco CCNA Extended Access List Example


Now that the ACL has been defined, it needs to be applied to an interface.  As stated on the previous slide, it can be applied with to fa0/1 in the inbound direction or fa0/0 in the outbound direction.

Following the general rule learned earlier in the course, extended ACLs should be placed close to the source while standard ACLs should be placed close to the destination.  Since ACL 101 is an extended ACL it is applied closest to the source in the inbound direction utilizing the following commands:

interface fa0/1

ip access-group 101 in

Cisco CCNA Extended Access List Example


This slide demonstrates an extended access-list that will deny any source address from network telnetting to host  Note: TCP port 23 equates to telnet.  There is a permit ip any any at the end of the deny so all traffic other than the specified telnet is allowed.  Again, since the ACL is an extended ACL it is applied as close to the source as possible.

Cisco CCNA Extended Access List Example


This slide demonstrates an extended access-list that will deny any host from network from using HTTP to any destination.

This example demonstrates the use of pre-defined port numbers.  In the example www equates to port 80 which is the default port utilized from a browser when performing http.

Cisco CCNA Extended Access List Example



On the LAN_A router

access-list 110 deny ip

access-list 110 permit ip any any

int e0

ip access-group 110 in



On the LAN_B router

access-list 10 deny

access-list 10 permit any

int e0

ip access-group 10 out

Cisco CCNA Access List Confihuration Guidelines



Access list numbers indicate which protocol is filtered.

One access list per interface, per protocol, per direction is allowed.

The order of access list statements controls testing.

Place the most restrictive statements at the top of list.

There is an implicit deny any statement as the last access list test. Every list needs at least one permit statement.

Create access lists before applying them to interfaces.

Access lists filter traffic going through the router; they do not apply to traffic originating from the router.

Cisco CCNA Named Access Lists


Named access lists are just another way to create standard and extended access lists.  In medium to large enterprises, management of access lists can become, well, a real hassle over time.

For example, when you need to make a change to an access list, a frequent practice is to copy the access list to a text editor, change the number, edit the list, then paste the new list back into the router.

Named access lists allow you to use names to both create and apply either standard or extended access lists.

There is nothing new or different about these access lists aside from being able to refer to them in a way that makes sense to humans.

However, you do not need to delete the named access-list in order to make changes. This is one of the best benefits of named access-lists.

Cisco CCNA Named Standard ACL Example


The “troublemaker” named standard ACL will deny host (  from going out on E0 to subnet, all other hosts on subnet will be allowed.

The arrow represent the access list is applied as an outbound access list on interface E0.