Suggest an editImprove this articleRefine the answer for “How does a standard ACL differ from an extended ACL?”. Your changes go to moderation before they’re published.Approval requiredContentWhat you’re changing🇺🇸EN🇺🇦UAPreviewTitle (EN)Short answer (EN)**A standard ACL** filters traffic only by the source IP address, while an **extended ACL** filters traffic by source and destination IP address, protocol and ports. **Key point:** an extended ACL is far more flexible and is most often used in real networks.Shown above the full answer for quick recall.Answer (EN)Image## Standard ACL **Standard ACL** is a simple access control list that **filters traffic only by the source IP address**. ### What it takes into account: - only the **source IP** (where the traffic came from) ### What it does not take into account: - the destination IP address; - the protocol (TCP/UDP/ICMP); - ports. ### Characteristics: - simple to configure; - coarse filtering; - can block extra traffic. It is usually placed **closer to the destination**, so it does not cut off needed traffic too early. --- ## Extended ACL **Extended ACL** is an advanced access control list that **filters traffic by many parameters**. ### What it takes into account: - the source IP address; - the destination IP address; - the protocol (TCP, UDP, ICMP and others); - port numbers. ### Characteristics: - very flexible; - allows precise access control; - most often used in real networks. It is usually placed **closer to the source**, so it can block unwanted traffic right away. --- ## The main difference (table) | Criterion | Standard ACL | Extended ACL | |---|---|---| | Source IP | Yes | Yes | | Destination IP | No | Yes | | Protocol | No | Yes | | Ports | No | Yes | | Flexibility | Low | High | --- ## A simple example - **Standard ACL**: > "Allow or deny everything from this computer" - **Extended ACL**: > "Allow this computer access only to this server on this port"For the reviewerNote to the moderator (optional)Visible only to the moderator. Helps review go faster.