thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Commonly confused · Routing & Switching

Standard ACL vs Extended ACL: What's the Difference?

A standard access control list filters only on source IP address. An extended ACL can filter on source and destination address, protocol, and port numbers, giving much finer control.

Standard ACL

vs

Extended ACL

Standard ACLExtended ACL
Matches onSource IP onlySource IP, destination IP, protocol, ports
Numbered ranges (Cisco)1-99 and 1300-1999100-199 and 2000-2699
Placement ruleAs close to the destination as possibleAs close to the source as possible
GranularityCoarseFine
Example useRestrict who can reach VTY lines; NAT match listsBlock Telnet from one subnet to a server while allowing HTTPS
Implicit ruleImplicit deny any at endImplicit deny any at end
Remember it

Standard sees only who is sending; extended sees who, where, and what.

Exam tip

Placement is the most-tested point: standard near the destination, extended near the source. Also remember ACLs are processed top-down, first match wins, with an implicit deny.

Tested on

More Routing & Switching look-alikes