Extended ACLs

Extended ACLs allow you can be more precise in the packet filtering. You can evaluate the source and destination IP addresses, the type of the layer 3 protocol, source and destination port, and other parameters. Extended access lists are harder to configure and require more processor time than the standard access lists, but they enable a much more granular level of control.

Two steps are required to configure extended ACLs:

1. configure an extended ACL using the following command:


2. apply an access list to an interface using the following command:

R1(config) ip access-group ACL_NUMBER in | out

Extended access lists numbers are in ranges from 100 to 199 and from 2000 to 2699.


To better understand the usefulness of extended ACLs, consider the following example.

extended acl example

We want to enable the administrator’s workstation ( unrestricted access to Server ( We will also deny any type of access to the user’s workstation (

First, we will create a statement that will permit the administrator’s workstation access to Server:

configure extended acl 1

Now, we need to create a statement that will deny the user’s workstation access to Server:

configure extended acl 2

Lastly, we need to apply the access list to the Fa0/0 interface on R1:

apply extended acl

You should always place extended ACLs as close to the source as possible.


The command above will force the router to evaluate all packets trying to enter Fa0/0. If the administrator tries to access Server, the traffic will be allowed, because of the first statement. However, if User tries to access Server, the traffic will be forbidden because of the second ACL statement.

What if we need to allow traffic to Server only for certain services? For example, what if Server was an web server and users should be able to access the web pages stored on Server? Well, we can allow traffic to Server only to certain ports (in this case, port 80), and deny any other type of traffic. Consider the following example:

extended acl example 2

On the right side, we have a Server that serves as a web server, listening on port 80. We need to permit User to access web sites on S1 (port 80), but we also need to deny other type of access.

First, we need to allow traffic from User to the Server port of 80. We can do that using the following command:

configure extended acl 3

By using the tcp keyword, we can filter packets by source and destionation ports. In the example above, we have permited traffic from to on port 80. The last part of the statement, eq 80, specifies the destination port of 80.

Since at the end of each access list there is an implicit deny all statement, we don’t need to define any more statement. After applying an access list, every traffic not originating from and going to will be denied.

We need to apply our access list to the interface:

apply extended acl 2

We can verify whether our configuration was successful by trying to access Server from the User’s workstation using different types of traffic. For example, ping will fail:

extended acl ping fails

Telnet to the port 21 will fail:

extended acl telnet fails

However, we will be able to access Server on port 80 using our browser:

extended acl http success

Geek University 2022