Extended Access List Configuration With Packet Tracer

Here, with our Extended Access-List, we will prohibit PC1 to access the web and
ftp server. But PC0 can still access the server.
For our Extended Access-List, we can use the ACL Number 100 to 199.

Assign IP address to interfaces of routers

Double click Router0 and click CLI and press Enter key to access the command

prompt of Router0.
Router 0

Router>enable
Router# configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
Router(config)#interface FastEthernet 1/0
Router(config-if)# no shutdown
Router(config-if)# ip address 10.0.0.1 255.0.0.0
Router(config-if)#exit
Router(config)#interface FastEthernet 0/0
Router(config-if)# no shutdown
Router(config-if)# ip address 20.0.0.1 255.0.0.0
Router(config-if)#exit

Assign IP address to PCs

Double click PC 0 and click Desktop menu item and click IP Configuration. Assign

IP address 10.0.0.2/8 to PC 0.

Repeat same process PC1 and assign IP address 192.168.1.100/24.

Configure OSPF routing protocol

Router 0

Router(config)#router ospf 1
Router(config-router)#network 20.0.0.0 0.255.255.255 area 0
Router(config-router)#network 10.0.0.0 0.255.255.255 area 0
Router(config-router)#exit
Extended Access-List Configuration
Syntax

Router(config)#ip access-list extended ACL_Number / ACL_Name

Router 0

Router(config)#ip access-list extended 100

Router(config-ext-nacl)#deny tcp host 192.168.1.100 host 20.0.0.2 eq 80
Router(config-ext-nacl)#permit ip any any
Router(config-ext-nacl)#exit
Router(config)#ip access-list extended 101
Router(config-ext-nacl)#deny tcp host 192.168.1.100 host 20.0.0.2 eq 21
Router(config-ext-nacl)#permit ip any any
Router(config-ext-nacl)#exit

Applying Extended Access-List to the Interface

 After creating ACLs, we need to apply this ACL to the interface. For Extended
Access-List, it is better to apply this ACL, close to the source. So, for this
configuration, we will apply our extended access list to the FastEthernet 1/0
interface of the router. In other words, we will add ACL to the server face of the
router.
Router 0
Router(config)#interface FastEthernet 1/0
Router(config-if)#ip access-group 100 in
Router(config-if)#ip access-group 101 in
Router(config-if)#end (inbound)
Router#copy run start
Destination filename [startup-config]?
Building configuration...
[OK]
Testing Extended ACL
 web Server
 ftp Server