<![CDATA[The development of information systems (IS) in organizations demands a secure network infrastructure. However, critical service ports on internal servers, such as FTP, SSH, and HTTP, are often vulnerable to internal threats like active port scanning and unauthorized access. This study was conducted to design and test the effectiveness of the Extended Access Control List (ACL) number 110 method in establishing a layer-3 packet filtration system. The experiment was simulated using GNS3 software integrated with an authentic Cisco IOS image. The results demonstrate that the implementation of the Extended ACL method successfully segregated network access rights in a granular and adaptive manner. The filtration policy was consistently able to identify source parameters and destination ports at the transport layer. The system effectively maintained full access availability for the administrator's device for management purposes, while completely blocking all unauthorized traffic from general users attempting to exploit the ICMP protocol and critical service ports on the server. Internal validation through matches counter statistical data on the router confirmed that each data packet was inspected accurately based on the First-Match principle. Consequently, the final outcomes of this study prove that Extended ACL is highly effective as a proactive protection solution to isolate core servers from internal lateral threats without disrupting the overall stability of the organization's network interconnection]]>
