Understanding the network.pdf - Back to Home

trying to build ACLs with the command line. By the way, just in case you missed it,
when you add anything to an ACL, it is appended to the bottom. This means that if
you do not delete the ACL (with the global
configuration command) before you copy your new ACL into the running-config, all
your changes will be appended to the bottom of the old ACL.
Extended IP Access Control Lists
Extended IP access-lists require a little more care and feeding than standard IP lists,
because they provide additional matching capability. Standard ACLs are
straightforward, and this characteristic lends them to being utilized with distribution,
dialer, and route-map matching lists. Extended lists are used to create traffic filters,
and the feature that distinguishes this function is the operation/port-value pair
match. Extended ACLs are created line by line using the global configuration
command .
First, let's create an extended ACL without operator/value matches:
asbr-a2(config)#access-list 100 permit ip any 192.168.5.0 0.0.0.255
asbr-a2(config)#interface s0
asbr-a2(config-if)# ip access-group 100 in
This extended ACL permits all IP traffic from any source to any host on network
192.168.5.0 /24. All other traffic is discarded. Using ip as the protocol effectively
permits all IP protocol traffic. Alternatively, you can create filters that are protocolspecific.
The protocol choices are illustrated in Table 9.2. Extended lists, like
standard lists, provide the option to use any in place of a network address. If you
want to permit a host address instead of a network address range, the keyword
host is used along with the host's IP address.
Table 9.2. IP ACL Protocol Filtering Keywords
Enhanced Interior Gateway Routing Protocol
Protocol ACL Keyword
eigrp