Menu

show access list commands

How to Configure Extended ACLs – Exclusive Explanation

How to Configure Extended ACLs – Exclusive Explanation

/ /

The number of extended ACLs starts from 100 to 199 and 2000 to 2699, providing 799 possible extended numbered ACLs. We can also create extended ACLs with the name. Extended ACLs are used more than standard ACLs because of greater control and facilities.

Extended ACLs check packet source addresses, destination addresses, protocols, and port numbers. For example, an extended ACL can simultaneously allow FTP traffic from a network to a specific destination while denying all other traffic and web browsing.

Configuring Extended ACLs

Extended ACLs can filter protocols and port numbers. Network administrators can build extremely specified extended ACLs using either the port number or the name of well-known port numbers. The extended ACLs use logical operations such as eq for equal, neq for not equal, gt for greater than, and lt for less than.

The configuration steps for extended ACLs are not different than standard ACLs.  Like the standard ACLs, first, we configure ACLs, and then they are activated on an interface. The command syntax and parameters are more complex than standard ACLs due to additional features.

The order in which the statements are entered during configuration is the order in which they are displayed and processed. The command syntax for configuring Extended ACL is the following:

access-list <access-list-number> {deny | permit | remark} protocol {source source-wildcard} [operator port <port-number or name>] {destination destination-wildcard} [operator port [ port-number or name>]

The parameter detail is the following:-

access-list-number –  The parameter identifies the access list using a number. The range of extended ACL is from 100 to 199 and from 2000 to 2699.

deny – it denies access if the condition is matched.

Permit – it permits access if the condition is matched.

Remarks – This parameter is used to enter a remark and comment to the access list

protocol – The common protocol is ICMP, IP, TCP and UDP. The IP keyword is used to match any protocol.

Source –  This parameter specifies the number of the network or host from which the packet is being sent.

Source-wildcard – wildcard bits are applied to the source address. It is opposite to the subnet mask.

destination –  This parameter specifies the destination host or network, which is the packet’s destination.

destination wild-card – This is the wildcard for the destination network.

operator – This is an optional parameter for comparing source or destination port. The possible operands are lt, gt, eq, neq, and range.

established – This is also an optional parameter for the TCP protocol only. It shows the established TCP connection.

Note:- You can see that there are many keywords and parameters for extended ACLs, but it is unnecessary to use them all when configuring an extended ACL.

Example-1 Extended ACL Configuration

In this example, suppose you are a network administrator and want to allow website browsing only from the network 192.168.2.0/24. The web traffic uses port 80 for HTTP and port 443 for HTTPS traffic. The HTTP traffic requires flow back into the network from the website accessed by the clients.

The administration also wants to restrict this return traffic to HTTP exchange from the requested website while denying all other traffic. The figure below illustrates the ACL configuration for the same.

Extended ACLs

ACL 101 allows requests to port 80 (HTTP) and port 443 (HTTPS), while ACL 104 blocks all incoming traffic except for previously established connections. The permit statement in ACL 104 allows inbound traffic using the established parameter.

The established parameter also allows traffic that originates from the 192.168.2.0/24 network to return to that network. Without an established parameter, clients can send traffic to a web server but not receive traffic returning from the web server.

Applying Extended ACLs to Interfaces

In the previous example, you configured the ACL to allow users from the 192.168.2.0/24 network to browse HTTP and HTTPS websites. The ACL is configured, but it will not filter traffic until it is applied to an interface.

Just like standard ACL, it is necessary to consider whether the traffic to be filtered is going in or out. So when a user in the network 192.168.2.0/24 accesses a website on the server, traffic goes out to router3. When a user in the network 192.168.2.0/24 receives data from the server, traffic is coming into the local router.

In the above topology, Router3 has three interfaces. Remember that an extended ACL should be applied close to the source, so the closest interface to the source in this topology is fa0/1. Web request traffic from users on the 192.168.10.0/24 LAN is inbound to the fa0/0 interface, and return traffic from established connections to users on the LAN is outbound from the fa0/0 interface. So we will apply the ACL to the fa0/0 interface in both directions, as shown in the figure below.

Example- 2 Restrict FTP Connection

In this example, we must deny FTP traffic from subnet 192.168.1.0 and allow all other traffic to server0. The FTP uses TCP port 20 and 21, therefore the ACL requires both port name keywords FTP and ftp-data or eq 20 and eq 21 to deny FTP. So if we use name, then the command would be.

access-list 103 deny tcp 192.168.1.0 0.0.0.255 host 192.168.4.2 eq ftp

access-list 103 deny tcp 192.168.1.0 0.0.0.255 192.168.4.2 eq ftp-data

If we use port numbers instead of port names, the commands would be written as:

access-list 103 deny tcp 192.168.1.0 0.0.0.255 192.168.4.2 eq 20

access-list 103 deny tcp 192.168.1.0 0.0.0.255 192.168.4.2 eq 21

I have already discussed the implied deny in standard ACL. This ACL also contains implied deny, so to prevent the implied deny any statement at the end of the ACL from blocking all traffic, the permit ip any any statement must be added to the end.

The ACL should be applied inbound on the Fa0/1 interface to filter traffic from the 192.168.1.0/24 LAN as it enters the router interface. The figure below illustrates the configuration of the above-discussed ACL.

Example-3 Restrict Telnet Connection

Like FTP traffic, we can also configure and restrict telnet to any network or individual host. The example below denies Telnet traffic from any source to 192.168.4.2  (Server0) but allows all other IP traffic. The ACL will be configured on Router2, interface Fa0/0 outbound. The permit statement has also been added to ensure no other traffic is blocked.

Creating Named Extended ACLs

Just like named standard ACLs, we can configure named extended ACLs similarly. For creating named standard ACLs, follow the steps below.

  1. Enter into global configuration mode.
  2. Use the ip access-list extended  <name> command to define a name for the extended ACL and enter to named ACL configuration mode.
  3. In named ACL configuration mode, enter the conditions to permit or deny
  4. Exit the named ACL mode and apply the ACL to the desired interface.
  5. Return to privileged EXEC mode and verify the ACL with the show access-lists name command as well as using show running-config
  6. Save the entries in the configuration file with the copy running-config startup-config 
  7. To remove a named extended ACL, use the no ip access-list extended <name> in the global configuration command.

Example of Named Extended ACL

The figure below illustrates the named extended ACLs for FTP services. We have already configured this ACL for network 192.168.1.0/24 to restrict accessing the FTP services of server0.

So, let us create the same ACL with a name for the same network. The named ACL denies the users on the 192.168.1.0/24 LAN access to the FTP service to the server and allows all other traffic. The figure below illustrates the configuration.

Verifying Extended ACLs

ACL verification is an essential step in the ACL configuration. When ACL has been configured and applied to an interface, use show commands to verify the configuration. We can verify the ACLs using “show access-list” command, “show running-config” command and “show ip interface <interface-number>” command.

The extended ACLs do not implement the same internal logic and hashing function as standard ACLs. The output and sequence numbers are the order in which the statements were entered. Host entries are not automatically listed before range entries. The show ip interface verify the ACL on the interface and the direction in which it was functional.

After verifying the ACL configuration, confirm that the ACLs work according to plan. Check to block and permit traffic as expected.

Editing Extended ACLs

As discussed earlier, extended ACL editing is the same as standard ACL editing. The methods of editing extended ACL are the following:

  • Using Text editor– Copy the ACL and paste it into the text editor where the changes are made. Remove the current access list using the no access-list  Copy and paste back the modified ACL into the configuration.
  • Using Sequence numbers– This method deletes the sequence numbers and then re-enter the correct statement using the sequence number. Enter into named ACL configuration mode using ip access-list extended <name>. If the ACL is numbered instead of named, use the ACL number in place of the name parameter. ACEs can be inserted or removed.
How to Configure standard ACLs

How to Configure standard ACLs

/ /

Standard ACLs permit or deny traffic based on source addresses. They differentiate routes on a network using the IP address. The port and destination of the packet are not evaluated. Standard ACLs only contain a list of addresses or address ranges and a statement as to whether access to or from that address is permitted or denied.

The range of the standard ACLs is from 1 to 99. Cisco IOS Release 12.0.1 extended the range of standard ACLs by allowing 1300 to 1999. This means that we can configure a maximum of 798 standard ACLs.

To Configure and use numbered standard ACLs on a Cisco router. We must first create the standard ACL and then activate the ACL on a specific interface. The “access-list” global configuration command defines a standard ACL. The full syntax of the standard ACL command is as follows:

Router(config)# access-list access-list-number { deny | permit | remark }source [ source-wildcard ][ log ]

The detailed explanation of the syntax for a standard ACL.is follows:-

access-list-number – This is a decimal number from 1 to 99 or 1300 to 1999 for standard ACL.

deny – This should deny the traffic if the condition is matched.

Permit – This should permit traffic if the condition matches.

remark – Add a remark about entries in an IP access list to make it easier to understand and scan.

source – There are two ways to specify the source of the packet

  1. Use of 32-bit IP address in dotted-decimal format
  2. Use of keyword “any” as an abbreviation for source and source wildcard of 0.0.0.0 255.255.255.255.

Wildcard –Wildcard is an optional 32-bit value. It is applied to the source. It should be “one” in the bit position, which we want to ignore.

log-log is an optional value. It presents the information logging message about the packet that matches the entry to be sent to the console. The level of the message can be controlled using the logging console command.

The log message includes the number of ACLs, the source address, and the number of the packet. It is generated for the first packet that matches and then it is guaranteed after the interval of each 5 minutes included the packets permitted in the previous 5 minutes.

The Access Control Entry (ACE) is responsible for denying or permitting an individual host or a range of host addresses. To create a host statement in numbered ACL 1 that permits a specific host with the IP address 192.168.1.10, you would enter:

Router(config)# access-list 1 permit host 192.168.1.10

To create a statement that will permit a range of IPv4 addresses in a numbered ACL 1 that permits all IPv4 addresses in the network 192.168.1.0/24, the command would be like this:

Router(config)# access-list 2 permit 192.168.10.0 0.0.0.255

We can remove the ACL using the no access-list <access-list-number> command in global configuration mode. We can verify the access list using the show access-list command.

Before entering and creating an ACL, it is necessary to understand the purpose of each statement. However, the statement and remarks should be included to recall and understand the purpose of the ACL. The remark keyword is also used to document ACLs. Each remark is limited to 100 characters

The logic of Standard ACLs

Packets that enter the router through interface any interface are checked for their source addresses based on the entries of access control entries, for example:

access-list 1 deny 192.168.10.10

access-list 1 permit 192.168.10.0 0.0.0.255

access-list 1 deny 192.168.0.0 0.0.255.255

access-list 1 permit 192.0.0.0 0.255.255.255

If packets are permitted, they are routed through the router to an output interface. If packets are denied, they are dropped at the incoming interface.

Cisco IOS processed standard Access Control Entries sequentially. Therefore, the order in which Access Control Entries (ACEs) are entered is significant. For example, in Figure below ACL 2 contains two ACEs. The first ACE denies a range of addresses with the help of wildcard mask, The ACE denies hosts in the 192.168.11.0/24 network. The second ACE is for a specific host.

The statement examines a specific host: 192.168.11.10. The host is also in the range of the first entry. In other words, 192.168.11.10 is a host in the 192.168.11.0/24 network. So, the internal logic for standard access lists rejects the second statement and returns an error message because it is a subset of the previous statement. This is a conflict of the ACL statement.

Now look at the figure below. The configuration contains the same two statements but in reverse order. This is a valid sequence of statements because the first statement refers to a specific host, not a range of hosts. So, now the host 192.168.11.10 can access the network outside where the access-list 2 has applied.

Now look to ACL Configured with a host statement that is not in the range of a previous statement. The 192.168.30.10 host address is not a member of the 192.168.11.0/24 network, so this is a valid statement because there is no conflict between these two statement addresses.

Applying Standard ACLs to Interfaces

When standard ACL is configured, it is linked to an interface using the “ip access-group” command in interface configuration mode. The command syntax is the following:

Router(config-if)# ip access-group <access-list-number | access-list-name> <in | out>

To remove an ACL, enter the “no ip access-group” command on the interface, and then enter the “no access-list” command to remove the entire ACL.

Example 1 of Standard ACL

The figure below lists the steps and syntax to configure and apply a numbered standard ACL on a router.  This ACL allows only traffic from source network 192.168.2.0 to be forwarded out of interface FastEthernet 0/0. Traffic from other networks is blocked.

standard acls

The first line identifies the ACL as access-list 2. It permits traffic that matches the selected parameters. In this case, the 192.168.2.0 0.0.0.255 is allowed to access the network 192.168.4.0/24. The entry is an implicit deny all statement that is equivalent to adding the line access-list 2 deny 0.0.0.0 255.255.255.255 or access-list 2 deny any. The “ip access-group 2 out” interface configuration command links and ties ACL 2 to the FastEthernet 0/0 interface as an outbound filter.

So, ACL 2 only permits hosts from the 192.168.2.0/24 network to exit router R2. It denies any other network including the 192.168.2.0 network.

Example 2 of Standard ACL

The figure below illustrates an example of an ACL that permits a specific subnet except for a specific host on that subnet.

This ACL blocks traffic from all subnets, including specific addresses in the subnet that allow accessing the network. The first ACE denies the host 192.168.2.2 from accessing the network 192.168.3.0.

The second ACE permits all other hosts on the network 192.168.2.0/24 to access the network 192.168.3.0/24. Again, the implicit deny statement matches every other network. The ACL is applied and linked to the Fast Ethernet interface 0/0 in an outbound direction.

Example 3 of Standard ACL

The figure below is an example of an ACL that denies a specific host. This ACL replaces the previous example. This example still blocks traffic from host PC1 but permits all other traffic.

The first commands deny the host 192.168.2.2 from accessing the network 192.168.3.0/24. All other hosts are permitted to follow the following line. This means that all hosts from the 192.168.1.0/24, 192.168.2.0/24, and 192.168.4.0/24 networks will be allowed except host 192.168.2.2, which was denied in the first statement.

We have applied this ACL to interface FastEthernet 0/0 in the outbound direction. This ACL only affects network 192.168.2.0/24, So we can place this ACL inbound on interface FastEthernet 0/1 on Router3. I think this is the best place for this type of ACL.

Creating Named Standard ACLs

Naming an ACL is the best practice because naming makes ACL easier to understand. For example, an ACL configured to deny could be called NO_Telnet. The named ACL configuration mode and command syntax are slightly different then numbered ACL.

Use the ip access-list command in global configuration mode to create a named ACL. ACL names are alphanumeric, case-sensitive, and must be unique. The ip access-list standard <name> is used to create a standard named ACL, whereas the command ip access-list extended <name> is for an extended access list.

After entering the command, the router is in the named standard ACL configuration mode as indicated by the prompt. The difference between numbered and named ACLs is that the Numbered ACLs use the global configuration command access-list, whereas named IPv4 ACLs use the ip access-list command.

After entering the named ACL configuration mode, use permit or deny statements to specify one or more conditions for determining whether a packet is forwarded or dropped.  Apply the ACL to an interface using the ip access-group <in | out> command.

Example of Named Standard ACL

The figure below illustrates the commands configuring a standard ACL on router R3, interface FE0/0, that denies host 192.168.2.2 access to the 192.168.4.0/24 network. The ACL is named NO_ACCESS_Net4. Recall that the name is case-sensitive.

Commenting ACLs

We can comment on the ACL using the remark keyword about the ACE in any IP standard or extended ACL. The remarks make the ACL easier to understand. Each remark line is restricted to 100 characters. We can enter the comment before or after a permit or deny statement. The command syntax for remarks is as:

access-list <access-list_number> remark <remark> in global configuration mode. We can remove the remark using the no access-list <access-list_number> remark <remark> command in global configuration mode.

Example 4 Using Remarks with Numbered ACL

The numbered ACL 5 denies the 192.168.2.2  PC from accessing the network 192.168.4.0/24 but permits all other devices. The remarks are used in the ACL.

Example 5 Using Remarks with Named ACL

In this example, you can see a standard named ACL configuration. The remarks indicate that PC1 is not authorized to access PC0, but devices from all other networks are permitted.

Verifying ACLs

Using the show ip interface command, we can verify the ACL on the interface. The output of this command displays the number or name of the access list and the direction in which the ACL was applied.

We can also verify the ACL by issuing the show access-lists command on the router. The output of the command displays all ACL output. We can also view an individual access list using the show access-lists command followed by the access list number or name. We can also verify the ACL from a starting-config file.

Finally, the video below is the answer to Cisco Routing Switching “9.2.1.10 Packet Tracer Configuring Standard ACLs.” The video is essential for the students of CCNA as well as for those who want to learn standard ACLs

https://youtu.be/tqEAn5R9owY