Extended ACL's

Sure. You have two basic methodologies when applying access lists. There is the Specific Deny with a permit all else at the end. Then there is the Specific Permit with a deny all else at the end. The Specific Deny with a permit all else is easier tomaintain but less secure. This means that if you have not specifically blocked it then it will get through. A more secure, and more difficult, method is the Specific Permit with deny all else. You would do this in front of a www server. You could have an ACL something like this: Permit TCP Any Host 10.0.0.1 eq www. That could be your entire list. This would allow all www traffic to the www server with an IP address of 10.0.0.1. All other traffic would be denied by the implicit Deny that gets attached to ever ACL.

It is a good idea to get your most likely used statements at the top of an ACL. This speeds up processing because once an entry in an ACL is matched, it is applied and the rest of the ACL is not read. If you know most traffic will be web and then there are about 5 other rules that are unlikely but you need them, put the www ACL entry first so that it gets approved before looking at the more specific ACL entries.

An example of a Specific Permit: only www and ftp traffic will get through.
Permit TCP Any Host 10.0.0.1 eq www
Permit TCP Any Host 10.0.0.1 eq ftp
Deny IP Any Any (this is added whether you put it in or not.)

An example of a Specific Deny: all traffic except www will get through
Deny TCP Any Host 10.0.0.1 eq www
Permit IP Any Any (this must be added or no traffic will get through.)