Cisco routers support the following two basic types of IP ACLs:
Cisco 路由器支援以下兩種基本類型的 IP ACL：
- Standard IP ACLs specify matching rules for source addresses of packets only. The matching rules are not concerned with the destination addresses of packets nor with the protocols, whose data is carried in those packets. Matching rules specify ranges of networks, specific networks, or single IP addresses. Standard IP ACLs filter IP packets based on the packet source address only. They filter traffic based in the IP layer, which means that they do not distinguish between TCP, UDP, or HTTPS traffic, for example.標準 IP ACL（Standard IP ACL）只針對封包的來源位址指定比對規則，不涉及封包的目的位址，也不涉及這些封包所承載資料所屬的通訊協定。比對規則可指定網路範圍、特定網路，或單一 IP 位址。標準 IP ACL 僅根據封包來源位址過濾 IP 封包，它們在 IP 層過濾流量，這代表它們無法區分例如 TCP、UDP 或 HTTPS 之類的流量。
- Extended IP ACLs examine both the source and destination IP addresses. They can also check for specific protocols, port numbers, and other parameters, which allow administrators more flexibility and control.延伸 IP ACL（Extended IP ACL）會檢查來源與目的 IP 位址。它們也可以檢查特定的通訊協定、連接埠號碼與其他參數，讓管理員有更多的彈性與控制能力。
The figure illustrates and compares standard ACL and extended ACL filtering for IPv4 traffic.
圖中說明並比較了標準 ACL 與延伸 ACL 對 IPv4 流量的過濾方式。
A standard ACL can only specify source IP addresses and source networks as matching criteria, so it is not possible to filter based on a specific destination. For more precise traffic filtering, you should use extended ACLs.
標準 ACL 只能指定來源 IP 位址與來源網路作為比對條件，因此無法根據特定目的地進行過濾。若需要更精確的流量過濾，應使用延伸 ACL。
Extended ACLs provide a greater range of control. In addition to verifying packet source addresses, extended ACLs also may check destination addresses, protocols, and source and destination port numbers, as shown in the figure. They provide more criteria on which to base the ACL. For example, an extended ACL can simultaneously allow email traffic from a network to a specific destination and deny file transfers and web browsing for a specific host. The ability to filter on a protocol and port number allows you to build very specific extended ACLs. Using the appropriate port number or well-known protocol names, you can permit or deny traffic from specific applications.
延伸 ACL 提供更大範圍的控制能力。除了驗證封包來源位址之外，延伸 ACL 也可以檢查目的位址、通訊協定，以及來源與目的連接埠號碼，如圖所示。它們提供了更多可作為 ACL 依據的條件。例如，一條延伸 ACL 可以同時允許某個網路傳送電子郵件流量至特定目的地，並拒絕特定主機進行檔案傳輸與網頁瀏覽。能夠依通訊協定與連接埠號碼進行過濾，讓你能夠建立非常精確的延伸 ACL。透過適當的連接埠號碼或公認的通訊協定名稱，你可以允許或拒絕來自特定應用程式的流量。
The following are the two general methods that you can use to create ACLs:
以下是可用來建立 ACL 的兩種一般方法：
- Numbered ACLs use a number for identification of the specific access list. Each type of ACL, standard or extended, is limited to a preassigned range of numbers. For example, specifying an ACL number from 1 to 99 or 1300 to 1999 instructs the router to accept numbered standard IPv4 ACL statements. Specifying an ACL number from 100 to 199 or 2000 to 2699 instructs the router to accept numbered extended IPv4 ACL statements. Based on ACL number it is easy to determine the type of ACL that you are using. Numbering ACLs is an effective method on smaller networks with more homogeneously defined traffic.編號 ACL（Numbered ACL）使用數字來識別特定的存取清單。每種類型的 ACL（標準或延伸）都限定使用預先分配的數字範圍。例如，指定 1 到 99 或 1300 到 1999 之間的 ACL 編號，會指示路由器接受編號標準 IPv4 ACL 陳述式；指定 100 到 199 或 2000 到 2699 之間的 ACL 編號，則會指示路由器接受編號延伸 IPv4 ACL 陳述式。根據 ACL 編號，很容易判斷你正在使用哪種類型的 ACL。在流量定義較為單純一致的小型網路中，使用編號來管理 ACL 是一種有效的方法。
- Named ACLs allow you to identify ACLs with descriptive alphanumeric string (name) instead of the numeric representations. Naming can be used for both IP standard and extended ACLs.具名 ACL（Named ACL）讓你可以用描述性的英數字串（名稱）來識別 ACL，而不必使用數字表示。具名方式可用於 IP 標準與延伸 ACL。
Cisco IOS Software provides a specific configuration mode for named access lists, which is called Named Access List configuration mode. It is recognized by HOSTNAME(config-std-nacl)# CLI prompt. The Named Access List configuration mode provides more flexibility in configuring and modifying ACL entries.
Cisco IOS 軟體為具名存取清單提供一個特定的設定模式，稱為具名存取清單設定模式（Named Access List configuration mode），可以透過 HOSTNAME(config-std-nacl)# 的 CLI 提示字元加以辨識。具名存取清單設定模式在設定與修改 ACL 項目時提供更大的彈性。
For IPv4 and IPv6 packet filtering, you have to create separate ACLs. For each of the protocols (IPv4 or IPv6), you can create multiple ACLs that are differentiated by their numbers or names for IPv4 and by names only for IPv6. However, you are restricted in how many ACLs you can apply simultaneously, depending on the purpose of ACL. For instance, to filter traffic on an interface, you can apply only one ACL per protocol and traffic direction.
針對 IPv4 與 IPv6 封包過濾，你必須建立各自獨立的 ACL。對每種通訊協定（IPv4 或 IPv6），你都可以建立多個 ACL，這些 ACL 在 IPv4 中以編號或名稱區分，在 IPv6 中則只能以名稱區分。然而，你能同時套用多少個 ACL 會受到限制，這取決於 ACL 的用途。例如，若要在某個介面上過濾流量，每種通訊協定與流量方向只能套用一個 ACL。