| 3.2 |  | Types of IP ACLs |
| 3.2.2 |  | Extended ACLs |

| Extended ACLs control traffic by comparing both the source and destination addresses of the IP packets to the addresses configured in the ACL. For IP extended access lists, there are a number of well-known protocols that can be defined. The command syntax format of extended ACLs is shown in Figure .

Extended ACLs are most often used to test conditions because they provide a greater range of control than standard ACLs. An extended ACL can be used to allow Web traffic but deny File Transfer Protocol (FTP) or Telnet from non-company networks. Extended ACLs check for both source and destination packet addresses. They can also check for specific protocols, port numbers, and other parameters. This gives more flexibility to describe what checking the ACL will do. Packets can be permitted or denied output based on where the packet originated and based on its destination. After defining the ACL, it must be applied to the interface, either inbound or outbound .

The configuration shown in Figure illustrates how an extended ACL is used to permit traffic on the 10.1.1.x network and to receive ping responses from the outside while preventing unsolicited pings. In this example, all other traffic is permitted.