Extended ACL's using Source and Destination Port

#ccna #LazDiazCerts #cisco
LIKE, SHARE & SUBSCRIBE!

A new way to configure Extended ACL's

Register for my FREE Networking Engineer Assessment:

Sign up for my upcoming Volume 1 CCNA, Live, Online Coaching on March 21st:

*************************************
SEE LINKS & PROMOTIONS BELOW:

My E-Learning Platform...self-paced courses & Bootcamps:

My Website:

********************************
RESOURCES:

My CCNA R/S book on AMAZON:

My IP book on AMAZON:

-or-

PDF:

*********************************
SOCIAL MEDIA:

Linkedin:

Facebook:

Instagram:

Twitter:

My Daily Publication:

[MikeBookham]

Laz,
TLDR: Secure networks use/need source port ACLs.

I’ve been working in networking for over 30 years in various industries and this is not a new thing, there are always edge cases where source port ACLs are a necessity and I have used this on occasions.
Lian Thang has mentioned one case of a web server’s outbound traffic.
Another is for an NTP server-to-server query or response where both source and destination ports are 123.

This highlights the issue with certification, just because something isn’t in the syllabus doesn’t mean that it doesn’t exist or isn’t used/useful, real world experience is severely underrated by many.

BTW – Keep up the good work on imparting your knowledge.

Mike

[paulthangbawi]

I always enjoy watching your videos: very informative. One good reason when to filter port after the source IP and wildcard would be when applying extended ACL for returning established web traffic from a server where the source port is certain. An inbound interface from a server reply with web traffic, (80 | 443) for instance, heading towards a client can be managed either denied or permitted. I know that you know it is not the best way to do it, but that's one solid reason for sure.

[billtotman]

Another possible use: if they are expecting asynchronous traffic through an interface?