ccna 210-060

ccna 210-060.Extended ACLs match packets based on source and destination information at layers 3 and 4, and layer 4 information can include TCP and UDP port information. Extended ACLs have greater scalability and control over network access than standard ACLs. The following is the command syntax for configuring an extended numbered IPACL.Router(config) #access-list ( acl-# } (permit | deny| remark} protocol source-addr [source-wildcard] [operator operand] desti nation-addr [ destination wildcard] [operator operand] [established] [log]Similar to a standard ACL, ad-# specifies the ACL number. those in the range 100.199 or 2000.2699 are extended ACLs. the next value determines whether to allow or deny based on the criteria that follow. The third value specifies the protocol type. The administrator must specify IP, TCP, UDP, or another specific IP subprotocol. The source 1P address and wildcard mask identify the source of the traffic. The destination IP address and its wildcard mask are used to indicate the final destination of the network traffic. Although the port parameter can be defined as an optional, if the administrator does not use a number nor a well-known port name to specify the port, all traffic to the destination will be dropped or allowed.All ACLs assume implict deny, which means that if the packet does not match any of the criteria in the ACL, the packet will be dropped. ACLs - once established - should include at least one permit statement, otherwise all traffic will be dropped when the ACL is applied to the interface.Both standard and extended ACLs can be used to describe packets entering or leaving an interface. ACLs are looked up in a sequential manner, stopping to continue the search after the first matching statement is found, and the action to be taken is also defined in this statement.When a standard or extended numbered IPACL is created, the administrator must apply it to the correct interface. Applying an ACL to an interfaceThe command to apply an ACL to an interface is as follows: router(config-if)# ipaccess-group access-list-number {in | out} The following is the command to apply an ACL to a vty line.Router(config-line)# access-class access -list -number {in | out}82 Chapter 4 Implementing Firewall Technologies4.1.1.3 Standard and Extended Named IP ACLs