[Day 10] 4. Extended ACL

Extended ACL: Filtering Based on Multiple Parameters

An Extended Access Control List (ACL) provides more flexibility than a standard ACL by allowing you to filter traffic based on multiple parameters such as source/destination IP addresses, protocols (e.g., TCP, UDP, ICMP), and port numbers. This is particularly useful when you need to control specific communication between devices within a network.

Scenario 1: Blocking Communication Between Specific PCs

Imagine you have two groups of PCs:

• PC 1, 2, 3, ... ---- Router A ---- Router B ---- PC 10, 11, 12, ....

In this case, PC 1 (IP:

172.16.10.50

172.16.30.50

Commands:

1. Block traffic between PC 1 and PC 10:

   • Copy

     A(config)# access-list 110 deny ip host 172.16.10.50 host 172.16.30.50

   • This command denies PC 1 (
     Copy

     172.16.10.50

     ) from communicating with PC 10 (
     Copy

     172.16.30.50

     ) using any protocol (e.g., TCP, UDP, ICMP). To filter specific traffic types, replace
     Copy

     ip

     with protocols such as
     Copy

     tcp

     ,
     Copy

     udp

     , or
     Copy

     icmp

     .

2. Allow all other traffic:

   • Copy

     A(config)# access-list 110 permit ip any any

   • This command permits all other traffic between any source and any destination on the network.

Key Points:

• Order matters: ACLs are processed top to bottom. Therefore, always place the deny statement first and ensure there is at least one permit statement, otherwise, the implicit deny all at the end will block all traffic.
• If you only want to block specific types of traffic (e.g., TCP), you can replace
  Copy

  ip

  with the relevant protocol (e.g.,
  Copy

  TCP

  ).

Scenario 2: Allowing Only Specific Traffic (FTP in this Case)

Suppose you want to allow only FTP traffic (TCP port 21) into your network and block all other incoming traffic.

Commands:

1. Allow FTP Traffic (Port 21):

   • Copy

     A(config)# access-list 120 permit tcp any 172.16.10.0 0.0.0.255 eq 21

   • This command allows only FTP traffic (TCP port 21) from any source to the destination subnet
     Copy

     172.16.10.0/24

     .

2. Apply the ACL to the Interface:

   • Copy

     A(config)# int g0/1

   • Copy

     A(config-if)# ip access-group 120 in

   • This applies the ACL to inbound traffic on the GigabitEthernet 0/1 interface.

Generalized ACL Command Format:

Copy
A(config)# access-list <number> <permit/deny> <protocol> <source IP> <wildcard mask> <destination IP> <wildcard mask> eq <port>

• This setup allows only FTP traffic while blocking all other traffic due to the implicit deny all rule.
• Efficiency Tip: Place the most specific rules at the top of the ACL.

Scenario 3: Restricting Access to Specific Hosts and Ports

You have two networks:

• 172.16.10.0/24 (Network A)
• 172.16.30.0/24 (Network B)

You want to implement the following rules:

1. Allow all traffic between the two networks except for one specific host.
2. Only HTTP traffic (port 80) should be allowed to 172.16.30.100 from 172.16.10.0/24.
3. Block all other types of traffic to 172.16.30.100.

Commands:

1. Allow only HTTP traffic to 172.16.30.100:

   • Copy

     A(config)# access-list 120 permit tcp 172.16.10.0 0.0.0.255 host 172.16.30.100 eq 80

   • This allows only HTTP (TCP port 80) traffic from 172.16.10.0/24 to 172.16.30.100.

2. Deny all other traffic to 172.16.30.100:

   • Copy

     A(config)# access-list 120 deny ip any host 172.16.30.100

   • This denies all traffic from any source to 172.16.30.100, except HTTP.

3. Allow all other traffic between the two networks:

   • Copy

     A(config)# access-list 120 permit ip 172.16.10.0 0.0.0.255 172.16.30.0 0.0.0.255

   • This permits any traffic between 172.16.10.0/24 and 172.16.30.0/24 except the restricted traffic to 172.16.30.100.

4. Apply the ACL to the Interface (e.g., GigabitEthernet 0/1):

   • Copy

     A(config)# int g0/1

   • Copy

     A(config-if)# ip access-group 120 in

   • This applies the ACL to inbound traffic on the interface
     Copy

     g0/1

     .

Conclusion

Using extended ACLs, you can create highly specific rules to control traffic based on source/destination IP addresses, protocols, and ports, offering flexibility and security in managing network communication. Always ensure the correct order of rules and apply ACLs to the appropriate interfaces for effective filtering.