ACL: named extended — proto + src + dst

Security
Intermediate
12 min
4 steps
Cisco IOS-style

Build a *named* extended ACL WEB-IN that permits HTTP from a trusted host but blocks ICMP from the same host, then bind it inbound on R2.

Open this lab in your browser →

Free · no install · no account

Scenario

Numbered ACLs work but don't scale: 100-199 means at most 100 extended ACLs, the names are opaque, and there's no way to *insert* an entry without re-typing the whole list. Named extended ACLs are the modern Cisco answer: descriptive names, per-entry sequence numbers, sub-mode editing. `` ip access-list extended <NAME> permit|deny <proto> <src-form> <dst-form> ` Inside the sub-mode each line is permit|deny <proto> <src> <dst>. The address forms — host, any, <network> <wildcard>` — are identical to the numbered-ACL syntax you already know.

Topology

1 × switch, 3 × router · Cisco IOS-style

HUB — switch
H1 — router
H2 — router
R2 — router

What you will do

On R2, enter the named-extended-ACL sub-mode for WEB-IN: ip access-list extended WEB-IN. The list is empty until you add entries.
Inside the sub-mode, permit TCP from H1 (10.0.0.10) to anywhere: permit tcp host 10.0.0.10 any.
Add deny icmp host 10.0.0.10 any *after* the permit. With first-match semantics this means ICMP from H1 is blocked while TCP still passes.
Apply WEB-IN inbound on R2's Gi0/0 with ip access-group WEB-IN in.

Open this lab in your browser →

ACL: named extended — proto + src + dst

Scenario

Topology

What you will do

More labs on this topic

This lab in other languages