R1(config)# ip access-list extended incoming_traffic_gi1/0.100 R1(config-ext-nacl)# deny ip 192.168.1.0 0.0.0.255 192.168.3.0 0.0.0.255 log R1(config-ext-nacl)# 1000 permit ip any any