Lab Configure and Verify Extended IPv4 ACLs
Extended IPv4 access control lists (ACLs) are one of the most powerful tools available in network administration. They allow administrators to filter traffic based on a wide range of criteria beyond just source and destination IP addresses. In a lab environment, configuring and verifying these ACLs gives you hands-on experience that directly translates to real-world network security and traffic management. Whether you are preparing for a certification exam or building skills for your career, mastering extended IPv4 ACLs is essential.
What Are Extended IPv4 ACLs?
An extended IPv4 ACL is a set of rules that filters network traffic using multiple parameters. Unlike standard ACLs, which only check the source IP address, extended ACLs can evaluate:
- Source IP address
- Destination IP address
- Protocol type (TCP, UDP, ICMP, etc.)
- Source port
- Destination port
- TCP flags
Extended ACLs are typically numbered from 100 to 199 and 2000 to 2699, or they can be named for easier management. They are placed closest to the source of the traffic to minimize unnecessary bandwidth usage on the network Turns out it matters..
Lab Setup Requirements
Before you begin configuring extended IPv4 ACLs, you need a proper lab environment. Here is what you will need:
- Router(s) or switch(es) with IOS version that supports extended ACLs
- Console or terminal access to the devices
- Network topology with at least two devices that can communicate (for example, two routers connected via a serial or Ethernet link)
- PCs or hosts with IP addresses to generate test traffic
- Cabling (console cable, Ethernet cables, serial cables)
- Packet Tracer (if using Cisco Packet Tracer for simulation)
A common lab topology involves two routers connected back-to-back with a serial link and each router connected to a LAN segment. This setup allows you to test traffic filtering between different networks It's one of those things that adds up..
Configuring Extended IPv4 ACLs Step by Step
Step 1: Plan Your ACL Rules
Before typing any command, write down what you want to allow or deny. For example:
- Allow HTTP traffic from network 192.168.1.0/24 to network 10.0.0.0/24
- Deny Telnet traffic from any source to any destination
- Allow ICMP echo requests from network 192.168.1.0/24
Step 2: Enter Global Configuration Mode
Access your router and enter the configuration mode:
Router> enable
Router# configure terminal
Router(config)#
Step 3: Create the Extended ACL
Use the access-list command followed by the ACL number, protocol, source address, source port, destination address, and destination port.
Router(config)# access-list 100 permit tcp 192.168.1.0 0.0.0.255 10.0.0.0 0.0.0.255 eq 80
Router(config)# access-list 100 deny tcp any any eq 23
Router(config)# access-list 100 permit icmp 192.168.1.0 0.0.0.255 any
Router(config)# access-list 100 permit ip any any
Let me break down the first line:
- 100 is the ACL number (extended range)
- permit means allow the traffic
- tcp is the protocol
- 192.168.Even so, 1. 0 0.0.Consider this: 0. 255 is the source network with wildcard mask
- **10.0.0.Practically speaking, 0 0. 0.0.
Step 4: Apply the ACL to an Interface
ACLs do nothing until they are applied to an interface. Use the ip access-group command in the interface configuration mode:
Router(config)# interface GigabitEthernet0/0
Router(config-if)# ip access-group 100 in
Router(config-if)# exit
Placing the ACL in means it filters traffic entering the interface. Placing it out filters traffic leaving the interface Not complicated — just consistent. Surprisingly effective..
Step 5: Save Your Configuration
Always save your work to avoid losing changes after a reboot:
Router# copy running-config startup-config
Verifying Extended IPv4 ACLs
Verification is just as important as configuration. Without proper verification, you cannot be sure your ACL is working as intended And it works..
Use the show access-lists Command
This command displays all ACLs configured on the device along with hit counts:
Router# show access-lists
You will see output similar to:
Extended IP access list 100
10 permit tcp 192.168.1.0 0.0.0.255 10.0.0.0 0.0.0.255 eq 80 (5 matches)
20 deny tcp any any eq 23 (12 matches)
30 permit icmp 192.168.1.0 0.0.0.255 any (3 matches)
40 permit ip any any (100 matches)
The numbers in parentheses show how many packets matched each rule. This helps you identify which rules are being hit.
Use the show ip interface Command
This command shows which ACL is applied to each interface and in which direction:
Router# show ip interface GigabitEthernet0/0
Look for the line that says "IP access list". It will display the ACL number and whether it is applied inbound or outbound.
Test with Ping and Telnet
From a host in the permitted network, try to access HTTP on the destination network. From any host, try to initiate a Telnet connection. Observe the results and compare them with your ACL rules.
Use Debug Commands Carefully
For real lab devices, you can use debug ip packet to see packets being processed. On production networks, avoid debug commands as they can overwhelm the CPU Most people skip this — try not to..
Router# debug ip packet 100
This shows only packets that match ACL 100 Simple, but easy to overlook..
Common Use Cases for Extended IPv4 ACLs
Extended IPv4 ACLs are used in many scenarios in enterprise networks:
- Security filtering: Block specific services like Telnet, FTP, or risky ports
- Traffic shaping: Allow or restrict certain application traffic
- Network segmentation: Control communication between VLANs or departments
- Remote access control: Permit only specific management protocols from admin networks
- Lab testing: Simulate real-world filtering scenarios in a controlled environment
To give you an idea, a common security rule is to deny Telnet (TCP port 23) from any source to any destination because Telnet sends credentials in plain text. Instead, administrators permit SSH (TCP port 22) for secure remote management.
Troubleshooting Extended IPv4 ACLs
If your ACL is not working as expected, check the following:
- Order of rules matters: ACLs are processed top-down. If a permissive rule appears after a deny rule, the permissive rule will never be reached
- Wildcard masks: Ensure your wildcard masks are correct. Remember that 0.0.0.255 matches the last octet
- Direction of application: An inbound ACL on the wrong interface will not filter the traffic you expect
- Implicit deny: Every ACL has an implicit deny all at the end. If none of your rules match, traffic is dropped
- Port numbers: Double-check that you are using the correct port numbers (HTTP is 80, HTTPS is 443, SSH is 22, Telnet is 23)
FAQ
Can I use named ACLs instead of numbered ACLs? Yes. Named ACLs use descriptive names instead of numbers, making them easier to manage. The syntax is slightly different but the functionality is the same It's one of those things that adds up..
**What is the difference between
What is the difference between standard and extended ACLs? Standard ACLs can only filter based on source IP address, while extended ACLs can filter based on source and destination IP addresses, protocol types, and port numbers. Extended ACLs provide much more granular control but require more processing overhead.
How many ACLs can be applied to a single interface? One ACL per protocol (IP) per direction. This means you can apply one inbound and one outbound ACL on each interface Worth knowing..
Can ACLs affect network performance? Yes, especially on lower-end devices. Each packet must be checked against ACL rules, which consumes CPU resources. Even so, modern routers handle ACLs efficiently, and the security benefits typically outweigh the minimal performance impact.
Best Practices
When implementing extended IPv4 ACLs, follow these guidelines:
- Place specific deny rules at the top of your ACL to catch unwanted traffic early
- Use remarks to document the purpose of each rule for future maintenance
- Regularly review and optimize ACL rules to remove obsolete entries
- Test ACLs thoroughly in a lab environment before deploying to production
- Keep ACLs as concise as possible to minimize processing overhead
Conclusion
Extended IPv4 ACLs are powerful tools for network security and traffic management. Remember that ACL configuration requires careful planning and testing, as even small mistakes can lead to significant network disruptions. Think about it: by understanding how to properly configure, apply, and troubleshoot these access control lists, network administrators can effectively protect their infrastructure while maintaining necessary connectivity. With practice and adherence to best practices, extended ACLs become invaluable assets in any network security strategy.
