@MHM Cisco World, like @Richard Burts, I'm unfamiliar with what an "extensive" ACL is. I also did a quick search for it, didn't find any information. Could you provide any Cisco reference links explaining this ACL kind?
BTW, @cp165125, what @Richard Burts suggested as the correct answer, is probably the answer being sought by whoever provided that question. Again, though, the way the question is worded, it's not a correct answer.
BTW, an example of an extended ACL ACE, that would block FTP using the expected assigned port would be:
access-list 100 deny tcp any any eq ftp !ftp symbolic for port 21
Such could be used on an ingress ACL on the Internet facing interface.
Again, as FTP can use any port, so the above ACE will not block all possible FTP traffic, but an ACL ACE to block such usage would be:
access-list 100 deny tcp any any range 0 65535
A problem with the foregoing, although it would block FTP, it also effectively blocks all other TCP traffic too.
In my reply to Rick, I mentioned something that does deeper packet inspection might work. One possible feature, that Cisco often supports on routers might be to use NBAR. The reason for might, sometimes NBAR is nothing more than a pretty face for an ACE. However, for FTP, some NBAR documentation has:
|
Internet
|
FTP
|
TCP
|
21, 21000, Heuristic
|
File Transfer Protocol
|
ftp
|
Cisco IOS XE Release 2.3
|
The word of interest, in the above, is "Heuristic", which I believe denotes further deeper packet inspection is done.
I.e. NBAR might match FTP using any port.
If so, using it would be something like:
class-map match-any FTP
match protocol ftp
policy-map BlockFTP
class FTP
drop
Using the above service-policy as an ingress policy on the Internet facing interface.
