Chapter 17: Access Control List Configuration Guide258 SmartSwitch Router User Reference Manualalways be listed ahead of rules that are less specific. For example, the following ACLpermits all TCP traffic except those from subnet 10.2.0.0/16:When a TCP packet comes from subnet 10.2.0.0/16, it finds a match with the first rule.This causes the packet to be dropped. A TCP packet coming from other subnets does notmatch the first rule. Instead, it matches the second rule, which allows the packet to gothrough.If you were to reverse the order of the two rules:all TCP packets would be allowed to go through, including traffic from subnet 10.2.0.0/16.This is because TCP traffic coming from 10.2.0.0/16 would match the first rule and beallowed to go through. The second rule would not be looked at since the first matchdetermines the action taken on the packet.Implicit Deny RuleAt the end of each ACL, the system automatically appends an implicit deny rule. Thisimplicit deny rule denies all traffic. For a packet that doesn’t match any of the user-specified rules, the implicit deny rule acts as a catch-all rule. All packets match this rule.This is done for security reasons. If an ACL is misconfigured, and a packet that should beallowed to go through is blocked because of the implicit deny rule, the worst that couldhappen is inconvenience. On the other hand, if a packet that should not be allowed to gothrough is instead sent through, there is now a security breach. Thus, the implicit denyrule serves as a line of defense against accidental misconfiguration of ACLs.To illustrate how the implicit deny rule is used, consider the following ACL:With the implicit deny rule, this ACL actually has three rules:If a packet comes in and doesn't match the first two rules, the packet is dropped. This isbecause the third rule (the implicit deny rule) matches all packets.acl 101 deny tcp 10.2.0.0/16 any any anyacl 101 permit tcp any any any anyacl 101 permit tcp any any any anyacl 101 deny tcp 10.2.0.0/16 any any anyacl 101 permit ip 1.2.3.4/24acl 101 permit ip 4.3.2.1/24 any nntpacl 101 permit ip 1.2.3.4/24 any any anyacl 101 permit ip 4.3.2.1/24 any nntp anyacl 101 deny any any any any any
