Configuring extended ACLs

Standard ACLs use only source IPv4 addresses for filtering criteria, extended ACLs use multiple filtering criteria. This enables you to more closely define your IPv4 packet-filtering.

Extended ACLs enable filtering on source and destination IPv4 addresses (required), in one of the following options:
  • Source and destination IPv4 addresses for filtering criteria, extended ACLs use multiple filtering criteria. This enables you to more closely define your IPv4 packet filtering. Extended ACLs enable filtering on the following:

    • specific host

    • subnet or group of addresses

    • any address

  • choice of any IPv4 protocol

  • optional packet-type criteria for IGMP and ICMP traffic

  • optional source and/or destination TCP or UDP port

  • filtering for TCP traffic based on either TCP control bits or whether the subject traffic is initiating a connection ("established" option)

  • optional IP precedence and ToS criteria

Switches allow up to 512 ACLs, and determines the total from the number of unique identifiers in the configuration. For example, configuring two ACLs results in an ACL total of two, even if neither is assigned to an interface. If you then assign a nonexistent ACL to an interface, the new ACL total is three, because the switch now has three unique ACL names in its configuration.