ACLs: Standard vs Extended, Where to Apply

Access control lists

- Standard (1–99, or named): match the source only. Place them close to the destination. - Extended (100–199, or named): match protocol, source, destination and ports. Place them close to the source. - Processed top-down, first match wins, and every ACL ends with an invisible deny any. - One ACL per interface, per direction, per protocol: ip access-group NAME in|out.

ip access-list extended WEB-ONLY permit tcp 192.168.1.0 0.0.0.255 host 10.1.1.10 eq 443 deny ip any any

Check hits with show access-lists — the match counters tell you which line is doing the work.