CCNA Cisco Certified Network Associate Study Guide - FTP Server

448 Chapter 9 � Managing Traffic with Access Lists
Extended IP Access Lists
In the standard IP access list example, notice how you had to block the whole
subnet from getting to the finance department. What if you wanted them to
gain access to only a certain server on the Finance LAN, but not to other network
services, for obvious security reasons? With a standard IP access list,
you can’t allow users to get to one network service and not another. However,
extended IP access lists allow you to do this. Extended IP access lists
allow you to choose your IP source and destination address as well as the
protocol and port number, which identify the upper-layer protocol or application.
By using extended IP access lists, you can effectively allow users
access to a physical LAN and stop them from using certain services.
Here is an example of an extended IP access list. The first command shows
the access list numbers available. You’ll use the extended access list range
from 100 to 199.
RouterA(config)#access-list ?
IP standard access list
IP extended access list
IPX SAP access list
Extended 48-bit MAC address access list
IPX summary address access list
Protocol type-code access list
DECnet access list
XNS standard access list
XNS extended access list
Appletalk access list
48-bit MAC address access list
IPX standard access list
IPX extended access list
At this point, you need to decide what type of list entry you are making.
For this example, you’ll choose a deny list entry.
RouterA(config)#access-list 110 ?
deny Specify packet
dynamic Specify a DYNAMIC list of PERMITs or DENYs
permit Specify packets to forward