5.3Access control lists (ACLs)

An ACL is an ordered list of rules that a router/switch evaluates one line at a time to decide "which traffic to pass and which to stop." In practice you translate requirements like "block only a specific port to a specific server" or "cut only the traffic from one department to another" into judgments about standard versus extended, on which interface's in/out direction, and in what order to write the entries. Because a wrong order or placement can block unintended traffic, an accurate understanding of the mechanism is essential.

5.3.1Standard ACLs and extended ACLs

• A standard ACL permits/denies based on the source IP address only. Its number range is 1-99 (expanded range 1300-1999). Since the only criterion is the source, placing it near the source would drop "all traffic from that source to every destination" at once. Therefore the rule is to place it on an interface near the destination so it does not sweep up needed traffic.
• An extended ACL judges more finely, specifying the source IP, destination IP, protocol (TCP/UDP/ICMP, etc.), and port number. Its number range is 100-199 (expanded range 2000-2699). Because it can pinpoint exactly the intended traffic, the rule is to place it on an interface near the source to drop unwanted traffic early and avoid wasting bandwidth.
• A named ACL uses a meaningful name instead of a number (ip access-list standard NAME / ip access-list extended NAME). You still specify standard vs extended, but its advantage over numbered ACLs is that you can insert/delete lines by sequence number, giving high editability. Numbered vs named is merely a difference in identification; the filtering capability is determined by the standard/extended distinction.