Content

| 6.1 |  | Characteristics of Transport Layer Technologies |
| 6.1.5 |  | Extended access control lists |

Standard IP access lists can permit or deny packets based only on the source IP address of the packet. Extended access lists have more features and can be used to target very specific traffic based on any combination of the following:

- Source address
- Destination address
- Source port
- Destination port

Extended access lists can also be used to filter ICMP traffic based on ICMP type and code.

Because extended access lists can filter on destination address, they should be implemented as close as possible to the source of the traffic being filtered, typically at the edge of an organization's network. This enables traffic to be examined and filtered before crossing expensive and congested WAN links within the organization.

Numbered extended access lists are primarily used to filter traffic being forwarded through a router and can be configured to use the number ranges 100-199 and 2000-2699.

Named extended access lists are also primarily used to filter traffic being forwarded through a router and are often used to provide better documentation of the configuration on the router.

Figure shows the command syntax to create a numbered extended access list.

Figure shows the command syntax to create a named extended access list.