Standard vs Extended Access list? Whats the difference?

JoloNation

Hi guys.

i just wanna clarify things up. the way i understand the 2 access list is like this.. Ready?

correct me if im wrong. i really appreciate the criticism and help.

standard access-list - you can permit the IP address but you cant control the destination.
extended access list- you can permit/block the IP at the same time you can control the the destination of the source.

if you can give me an example. much better! thank you and God Bless guys!
More Power.

DevilWAH

JoloNation wrote: »

Hi guys.

i just wanna clarify things up. the way i understand the 2 access list is like this.. Ready?

correct me if im wrong. i really appreciate the criticism and help.

standard access-list - you can permit the IP address but you cant control the destination.
extended access list- you can permit/block the IP at the same time you can control the the destination of the source.

if you can give me an example. much better! thank you and God Bless guys!
More Power.

With standard you are right its pretty much you are controlling based on source source.

Extended you can do more though that just source and destination. you can also control based on UDP/TCP port numbers as well as a number of other values.

Standard IP access list 1
10 permit 149.1.25.36
20 permit 149.1.25.37

so this will only permit traffic from the two IP address (remember there is default deny all at the end of an access list ). but standard access lists are always just "line number -- permit/deny -- source IP address -- [log]"


Extended IP access list Lync-Video
10 deny ip host 149.1.63.45 any
20 deny ip any host 149.45.21.5
30 permit udp any range 20040 20079 any range 20040 20079
40 permit tcp any range 20040 20079 any range 20040 20079

this will deny ip traffic from host 149.1.63.45 to anything else
and deny traffic to ip address 149.45.21.5 from any where

it will also permit any host to talk talk to any host over the stated UDP and TCP ports, again every thing else is denied by the default deny statement.

So extended is exactly what it says, taking the basic idea of an access list they are structured identically, but giving more granular control on the data you are premiting / denying

format is

"[seq number] -- permit/deny -- protocol - source - destination -- [port] - [log] there are more choices than this but this is a good basic syntax to remember )

DevilWAH

Oh and also look at using IP access lists where you can.

While the syntax and structure is pretty much identical, the big difference is the ability to number the lines and insert and remove with out recreating the whole list each time. Very good when working with large lists. you can also use names on IP access lists (as you can see in my last post that makes it easier to follow what each one is for.

(note in later versions of IOS on cisco at least you can treat standard access lists like IP access lists and they are completely interchangeable so you can add and subtract statements on the fly.)

entering the commands

#ip access-list extended Lync-Video
#10 permit ip any any log
#20 deny udp 12.15.36.45 any
#no 10
#10 permit ip 14.26.35.15 8.8.8.8
#15 permit udp 12.15.36.45 eq 53 log

would result in an access list of

10 permit ip 14.26.35.15 8.8.8.8
15 permit udp 12.15.36.45 eq 53 log
20 deny udp 12.15.36.45 any