Chapter 10: Security Configuration Guide172 SmartSwitch Router User Reference Manualahead of rules that are less specific. For example, the following ACL permits all TCPtraffic except those from subnet 10.2.0.0/16:When a TCP packet comes from subnet 10.2.0.0/16, it finds a match with the first rule.This causes the packet to be dropped. A TCP packet coming from other subnets will notmatch the first rule. Instead, it matches the second rule which allows the packet to gothrough.If you were to reverse the order of the two rules:then all TCP packets will be allowed to go through, including traffic from subnet10.2.0.0/16. This is because TCP traffic coming from 10.2.0.0/16 will match the first ruleand be allowed to go. The second rule will not looked at since the first match determinesthe action on the packet.Implicit Deny RuleAt the end of each ACL, the system automatically appends an implicit deny rule. Thisimplicit deny rule denies all traffic. For a packet that doesn't match any of the userspecified rules, the implicit deny rule acts as a catch all rule. All packets match correctlywith this rule. The default behavior for a packet that doesn't match any rules in an ACLcan be either to permit or to deny. The SSR chooses to deny a packet as the defaultbehavior. This is done for security reasons. If an ACL is misconfigured and a packet thatshould be allowed to go through is now blocked because of the implicit deny rule, theworse that could happen is inconvenience. On the other hand, if a packet that should notbe allowed to go through is instead sent through, there is now a security breach. Basically,the implicit deny rule is the last line of defense against accidental mis-configuration ofACLs that could result in a security breach.To describe how the implicit deny rule is used, considering the following example.Suppose someone created the following ACL:With the implicit deny rule, this ACL actually has three rules:acl 101 deny tcp 10.2.0.0/16 any any anyacl 101 permit tcp any any any anyacl 101 permit tcp any any any anyacl 101 deny tcp 10.2.0.0/16 any any anyacl 101 permit ip 1.2.3.4/24acl 101 permit ip 4.3.2.1/24 any nntpacl 101 permit ip 1.2.3.4/24 any any anyacl 101 permit ip 4.3.2.1/24 any nntp anyacl 101 deny any any any any any
