Corporate Headquarters

•
Network address translation
•
Cisco Encryption Technology
•
IPSec network security
•
Neighbor router authentication
•
Event logging
•
User authentication and authorization
Note
Refer to the “Traffic Filtering and Firewalls” part of the 
Cisco IOS Security Configuration Guide
and 
the
 Cisco IOS
Security Command Reference 
for advanced firewall configuration information. For 
information on how to access these documents, see 
“Related Documentation” section on page xi
.
This section explains how to configure an extended access list, which is a sequential collection of permit 
and deny conditions that apply to an IP address.
This section includes the following topics:
•
Creating Extended Access Lists Using Access List Numbers
•
Verifying Extended Access Lists
•
Applying Access Lists to Interfaces
•
Verifying Extended Access Lists Are Applied Correctly
Note
The extended access list configuration explained in this section is different from the crypto access list 
configuration explained in the 
“Creating Crypto Access Lists” section on page 3-22
. Crypto access lists 
are used to define which IP traffic is or is not protected by crypto, while an extended access list is used 
to determine which IP traffic to forward or block at an interface.
The simplest connectivity to the Internet is to use a single device to provide the connectivity and firewall 
function to the Internet. With everything being in a single device, it is easy to address translation and 
termination of the VPN tunnels. Complexity arises when you need to add extra Cisco 7200 series routers 
to the network. This normally leads people into building a network where the corporate network touches 
the Internet through a network called the DMZ, or demilitarized zone.