Standard access control lists are powerful, but their blunt approach—blocking all traffic from a source address regardless of application—is too restrictive for modern enterprise requirements. For example, a company may want remote employees to browse the corporate web portal freely, while strictly blocking those same employees from establishing SSH terminal sessions to the underlying web server.
To implement this level of precision, network engineers deploy Extended Access Control Lists. Extended ACLs inspect the entire five-tuple of a packet: source IP, destination IP, transport protocol, source port, and destination port. In this chapter, you will build extended ACL statements, filter specific application services, and learn why extended ACLs belong close to the traffic source.
The Syntax and Structure of Extended ACLs
Extended access lists use numbers between 100 and 199 (or named format) and introduce rich protocol operator keywords. The standard syntax structure follows this pattern:
Router(config)# access-list [100-199] [permit|deny] [protocol] [source-ip] [source-wildcard] [dest-ip] [dest-wildcard] [operator] [port-number]Let us break down a real-world enterprise configuration statement:
Router(config)# access-list 101 permit tcp 192.168.1.0 0.0.0.255 host 10.0.0.50 eq 443This single command instructs the router: Permit TCP packets originating from any host on the 192.168.1.0/24 subnet, destined specifically for host 10.0.0.50, provided the destination port equals (eq) 443 (HTTPS secure web). Any other traffic, such as FTP (port 21) or Telnet (port 23), fails to match this line and continues down the list toward the implicit deny rule.
| Application Service | Transport Protocol | Port Number | Keyword Operator | Security Significance |
|---|---|---|---|---|
| Web Browsing (HTTP) | TCP | 80 | eq 80 (or eq www) | Unencrypted web traffic; usually permitted |
| Secure Web (HTTPS) | TCP | 443 | eq 443 | TLS encrypted web; essential standard |
| Domain Resolution (DNS) | UDP / TCP | 53 | eq 53 (or eq domain) | Name lookups; critical for internet browsing |
| Secure Shell (SSH) | TCP | 22 | eq 22 | Encrypted terminal; restrict to administrators |
| Ping and Diagnostics (ICMP) | ICMP | N/A (Type/Code) | echo, echo-reply | Network health checks; selectively permitted |
Common Extended ACL Port Operators
Extended access lists provide flexible comparison operators beyond simple equality (eq). These operators allow you to define port ranges and service thresholds with minimal configuration lines:
eq [port]: Equal to. Matches the exact specified port number.neq [port]: Not equal to. Matches all ports except the specified number.lt [port]: Less than. Matches all port numbers below the given value.gt [port]: Greater than. Matches all port numbers above the given value (for example,gt 1023matches all ephemeral dynamic ports).range [start] [end]: Inclusive range. Matches any port between the start and end boundaries (for example,range 20 21covers FTP data and control).
The Golden Rule of Extended ACL Placement
Unlike standard ACLs which belong close to the destination, the universal guideline for extended access control lists is: Place Extended ACLs as close to the source as possible.
Because extended ACLs know both the source and destination addresses as well as the exact application port, there is zero risk of unintentionally dropping desired traffic for other destinations. Dropping unauthorized packets immediately at the source edge router prevents that invalid traffic from needlessly consuming bandwidth across your expensive corporate WAN links and core backbones.
Hands-On Lab Practice
In this lab exercise, you will test an extended access control list deployed on a campus perimeter router. The security policy states: Workstations may send web traffic (HTTP port 80 and HTTPS port 443) and ping diagnostic queries to a remote server, but all SSH remote management access (TCP port 22) from standard users must be blocked.
You will execute simulated web requests and terminal connections, observe the router filter table counters increment, and confirm that granular port filtering provides security without disrupting normal user productivity.