ACL Operation
ACLs are rules created by a network professional on the router or firewall appliance to filter traffic either entering or leaving the device. ACLs are a list of security rules, and each ACL contains either a permit or deny statement. Each statement within an ACL is called an access control entry (ACE). ACEs are the real workers that allow and block packets between networks. When a router receives packets on an interface, the router checks each ACE, starting with the first entry at the top of the list and moving down until a match is found. Once an ACE match is found, the router stops searching and executes the rule on the ACE – whether to permit or deny the traffic. This process is known as packet filtering.
Note
If no matches are found in the ACLs, the packet is discarded by the router. The last ACE within all ACLs is an implicit deny statement. An implicit deny statement simply says that if no matches are found in the previous ACEs, deny the packet. The...
