Standard access lists offer quick configuration and low overhead processing in limiting network traffic.
|
Extended access lists provide a higher degree of control than standard access lists.
|
You can use extended access lists to enable filtering based on

• protocol
|
• source or destination address
|
• application port number
|
These features make it possible to limit traffic based on the uses of the network.
|
Each packet processed by an extended access list entry must match all options that are configured in that entry.
|
Then the packet is permitted or denied in accordance with the entry.
|
Just as with standard access lists, the first matching entry in the access list determines how the packet will be treated.

You can also specify inbound or outbound processing for extended access lists.
|
If no access list is present then, by default, the packet is permitted.
|
If an extended access list is defined then the packet's source IP address is checked.
|
If the source address matches then the destination address is checked.
|
If the destination address matches then the protocol and any protocol options are checked.
|
Only then is the packet explicitly permitted or denied.
@@
You use the Access-List command to create an entry in an extended IP access list.
|
The syntax of the command is

  access-list £Baccess-list-number£b {permit|deny}
    {protocol £Bprotocol-keyword£b}
    {£Bsource source-wildcard£b|any}
    {£Bdestination destination-wildcard£b|any}
    [precedence £Bprecedence£b] [tos £Btos£b]
|
This is the general syntax of the Access-List command for defining extended access lists.

The syntax can vary considerably depending on the aim of a given command.
|
The £Baccess-list-number£b can be any value from 100 to 199.
|
The £Bprotocol£b parameter is the name or number of an IP protocol.
|
The £Bprotocol£b parameter can be one of the following keywords: eigrp, gre, icmp, igmp, igrp, ip, ipinip, nos, ospf, tcp, or udp, or an integer in the range 0 through 255 representing an IP protocol number.

To match any Internet protocol, including ICMP, TCP, and UDP, use the keyword £BIP£b.
|
The £BSource£b and £BDestination£b parameters are IP addresses, and are accompanied by corresponding wildcard masks.
|
You can use the keyword £BAny£b instead of configuring the address 0.0.0.0 and mask 255.255.255.255.
|
You can use the keyword £BHost£b before an IP address to replace the mask 0.0.0.0.
|
The £BPrecedence£b parameter can have a value from 0 to 7.
|
It indicates the precedence level at which packets are filtered.
|
The £BTOS£b (£RT£rype £Ro£rf £RS£rervice) parameter can have a value from 0 to 15.
|
This value indicates the type of service level specified for packet filtering.
@@
You can define an extended access list with protocol-specific options to filter traffic based on ICMP messages.
|
<F>The syntax for the Access-List ICMP command is

  access-list £Baccess-list-number£b {permit|deny} icmp
    {£Bsource£b £Bsource-wildcard£b|any}
    {£Bdestination£b £Bdestination-wildcard£b|any}
    [icmp type [£Bicmp-code£b]|£Bicmp-message£b]
    [precedence £Bprecedence£b] [tos £Btos£b]
|
The keyword £BICMP£b indicates that a different syntax is being used for this command, and that protocol-specific options are available.
|
<F>You use the Access-List TCP command to define an extended access list that filters traffic based on TCP port number.
|
The syntax for the Access-List TCP command is

  access-list £Baccess-list-number£b {permit|deny} tcp
    {£Bsource£b £Bsource-wildcard£b|any}
    [£Boperator£b £Bsource-port£b|£Bsource-port£b]
    {£Bdestination£b £Bdestination-wildcard£b|any}
    [£Boperator£b £Bdestination-port£b|£Bdestination-port£b]
    [established]
    [precedence £Bprecedence£b][tos £Btos£b]
|
Packets can be filtered by precedence level specified by a number from 0 to 7.
|
The numbers correspond to the precedence names shown here.
|
Packets can be filtered by type of service (TOS) level specified by a number from 0 to 15.
|
Examples of TOS names are shown here.
|
The protocol keyword £BTCP£b indicates that an alternate syntax is being used for this command and that protocol-specific options are available.
|
<F>You use the Access-List UDP command to define an extended access list that filters traffic based on UDP port number.
|
The syntax for the Access-List UDP command is

  access-list £Baccess-list-number£b {permit|deny} udp
    {£Bsource£b £Bsource-wildcard£b|any}
    [£Boperator£b £Bsource-port£b|£Bsource-port£b]
    {£Bdestination£b £Bdestination-wildcard£b|any}
    [£Boperator£b £Bdestination-port£b|£Bdestination-port£b]
    [established]
    [precedence £Bprecedence£b][tos £Btos£b]
|
The Precedence and TOS (Type of Service) names are the same as for TCP.

The protocol keyword £BUDP£b indicates that an alternate syntax is being used for this command and that protocol-specific options are available.
|
In the example shown here, the first line permits any incoming TCP connections with destination port numbers greater than 1023.
|
Source ports are defined as a number in the range from 0 to 255.

Destination ports are defined as a number above 1023.
|
The next line permits incoming TCP connections to the SMTP port (25) of host 172.16.1.2.
|
The last line permits incoming ICMP messages for error feedback.
@@
Let's consider another example of using an extended access list.
|
Say you have a network connected to the Internet.
|
You want any host on an Ethernet to be able to form TCP connections to any host on the Internet.
|
<F>But you do not want Internet hosts to be able to form TCP connections to hosts on the Ethernet, except to

• the mail (SMTP: 25) port of a 
  dedicated mail host
|
• the appropriate ports of a DNS 
  (42,53)/FTP (20,21) server
|
• the WWW port (80) of a World 
  Wide Web server
|
In the access list shown here, the first line allows existing TCP connections.
|
The next line permits ICMP messages.
|
The next line allows SMTP connections from any source to one host, 172.16.192.2, the mail server.
|
The access list allows WWW connections from any source to the World Wide Web server, 172.16.192.5, only.
|
The remainder of the list allows DNS and FTP (command and data) connections from any source to the DNS/FTP server, 172.16.192.10.
|
To apply the access list you first specify an interface.
|
In this case it is the serial 0 interface.
|
You use the IP Access-Group command to link the access list to the Serial 0 interface.
@@
Let's look at an example of configuring an extended access list on a Cisco router.
|
Network 172.16.0.0 is a class B network that has been subnetted; the third octet is now the subnet identifier (subnet mask 255.255.255.0).
|
The purpose of the access list here is to restrict traffic from the 172.16.128.0 subnet so that only Telnet traffic from the server (172.16.128.3) is accepted.
|
All other traffic from the subnet (for example FTP, SMTP) is denied.
|
In the example shown here, any traffic from the workstation (IP address 172.16.128.4) will be denied by the router.
|
Assume now that you are logged in to the SanFran router and that you have entered Privileged mode.
|
You enter £Rconfig term£r to access global configuration mode.
|
Let's define this access list as number 102.
|
First you permit TCP connections with any destination port on the 172.16.128.0 subnet greater than 1023.
|
Remember, source ports are numbers in the range 0 to 255.

Destination port numbers have values greater than 1023 (though 1024 is usually reserved).
|
To allow any incoming TCP connections with destination port numbers greater than 1023 you enter £Raccess-list 102 permit tcp any 172.16.128.0.0.0.0.255£r £Rgt 1023£r.
|
Next, you need to restrict access to incoming Telnet traffic.
|
You enter £Raccess-list 102 permit tcp any host 172.16.128.3 eq telnet£r.
|
Remember, the keyword £BHost£b can be used in front of an IP address in place of the mask 0.0.0.0.

You can also use the Telnet source port number, 23, in the command instead of "telnet".
|
Now you can make allowance for ICMP messages to facilitate error feedback.
|
So you enter £Raccess-list 102 permit icmp any host 172.16.128.3£r.
|
Next you specify an interface for access list number 102.
|
In this case the access list will be applied to outbound traffic on the SanFran router's E0 interface.
|
You enter interface configuration mode by entering £Rinterface ethernet 0£r.
|
Then you enter £Rip access-group 102 out£r.
|
You press £UCtrl+Z£u to leave Configuration mode.
|
And you can save the new configuration in NVRAM by entering £Rcopy run start£r.
@@
Let's look at the effect of the access list configuration.
|
Here, the SanFran router is connected to a LAN server (IP address 172.16.128.3).
|
The access list is applied to outbound traffic on the SanFran router's E0 interface.
|
So to test the effects of access list operation, you first log on to another router, in this case the Dublin router.
|
From the Dublin router you attempt to reach the server by entering £Rping 172.16.128.3£r.
|
As you can see the attempt is successful.
|
Now you can attempt to reach a workstation on the server's LAN by entering £Rping 172.16.128.4£r.
|
Here, the test fails.
|
The access list prevents contact using the Ping command from being made.
@@
Here you'll configure an extended access list on a Cisco router.
|
The goal of this access list is to filter traffic coming from an office LAN linked to the Sydney router.
|
You need to allow Telnet traffic from the LAN server (IP address 172.16.32.5), but deny traffic from the rest of the 172.16.32.0 subnet.
|
Assume that you are logged in to the Sydney router and that you have entered Privileged mode.
|
You enter £Rconfig term£r to access global configuration mode.
|
You enter £Raccess-list 104 permit any tcp 172.16.32.0 gt 1023£r to define access list number 104 allowing TCP traffic from client processes to the subnet.
|
To permit Telnet access to the server you enter £Raccess-list 104 permit tcp any host 172.16.32.5 eq telnet£r.
|
Alternatively you can complete the command by ending it with £Req 23£r.
|
Now you permit ICMP messages for error feedback from the server.
|
You enter £Raccess-list 104 permit icmp any host 172.16.32.5£r.
|
Next you need to link the access list to an interface, in this case the Sydney router's E0 interface (IP address 172.16.32.5).
|
You enter £Rinterface ethernet 0£r to access interface configuration mode.
|
You enter £Rip access-group 104 out£r to apply access list number 104 to outbound traffic on the Sydney router's E0 interface.
|
Then you press £UCtrl+Z£u to leave configuration mode.
@@
Now you can test your newly defined access list.
|
First you log on to another router, in this case the London router.
|
You enter £Rtelnet 172.16.66.1£r to log on to the London router.
|
You can confirm that the access list allows traffic from the server by entering £Rping 172.16.32.5£r.
|
You enter £Rping 172.16.32.6£r to try to reach a workstation on the server's subnet.
|
The workstation cannot be reached using the Ping command, indicating that the ICMP portion of the access list configuration is successful.
@@
