Standard vs Extended ACLs on Cisco IOS

Access Control Lists (ACLs) are essential for packet filtering and security on Cisco routers. Understanding when to use Standard versus Extended ACLs is a fundamental skill for any network engineer.

Standard ACLs

• Number Range: 1-99 and 1300-1999
• Filtering Capability: Source IP address only.
• Placement: Place as close to the destination as possible so you don’t inadvertently block legitimate traffic traversing the network.

Extended ACLs

• Number Range: 100-199 and 2000-2699
• Filtering Capability: Source IP, Destination IP, Protocol (TCP, UDP, ICMP), and Port Numbers.
• Placement: Place as close to the source as possible to drop unwanted traffic before it consumes network bandwidth.

Summary

Use Extended ACLs for granular control and Standard ACLs for simple source-based restrictions or classifying traffic for services like NAT.