What is the difference between standard, extended and named ACLs?
Show the answer
Say this first
A standard ACL matches only the source IP address. An extended ACL matches the protocol, source and destination addresses, source and destination ports, and extras like TCP flags, ICMP type and DSCP. A named ACL is not a third kind: it is a standard or extended ACL with a name instead of a number, and it lets me insert and delete single lines by sequence number. On IOS the numbered ranges are 1 to 99 and 1300 to 1999 for standard, 100 to 199 and 2000 to 2699 for extended.
Go deeper
Numbering on IOS
| Type | Numbers | Matches on |
|---|---|---|
| Standard IPv4 | 1 to 99, 1300 to 1999 | source address only |
| Extended IPv4 | 100 to 199, 2000 to 2699 | protocol, source, destination, ports, flags |
| Named | any name, standard or extended keyword | same as the type you pick |
The same intent in three styles
! Standard, numbered: only the source can be matched
access-list 10 permit 10.1.20.0 0.0.0.255
!
! Extended, numbered
access-list 110 permit tcp 10.1.20.0 0.0.0.255 host 10.2.50.10 eq 443
!
! Extended, named, with sequence numbers
ip access-list extended WEB-TO-SRV
10 permit tcp 10.1.20.0 0.0.0.255 host 10.2.50.10 eq 443
20 deny ip 10.1.20.0 0.0.0.255 10.2.50.0 0.0.0.255 log
30 permit ip any any
!
interface GigabitEthernet0/0/1
ip access-group WEB-TO-SRV inInterface filters are applied with ip access-group NAME in|out. On VTY lines the command is
access-class NAME in, usually with a standard ACL because only the source matters there.
ACLs are also a matching tool
The same ACL syntax selects traffic for NAT, route maps and PBR, QoS class maps, CoPP, crypto maps and
debug filters. In those uses permit means "this matches" and deny means "this does not match",
nothing is dropped by the ACL itself.
They will ask next
Can you edit a numbered ACL without retyping it?
Yes on any modern IOS.
ip access-list extended 110opens the numbered list in named-style mode, whereno 20removes one line and15 permit ...inserts one. The old global form is dangerous:no access-list 110 permit tcp ...deletes the whole ACL 110, not the single line.How many ACLs can you put on one interface?
One per protocol per direction: one IPv4 ACL in, one IPv4 ACL out, and the same again for IPv6. Applying a second
ip access-groupin the same direction replaces the first.
Traps
- Saying a standard ACL can match a destination. It sees only the source address.
- Typing
no access-list 110 ...in global config to remove one line. It removes the entire numbered list.