IPv4 Access Control Lists (ACLs)
IPv4 Static ACL Operation
Is there a
match?
Perform action
(permit or deny).
No
Test a packet against
criteria in first ACE.
Yes
No
Yes
Deny the packet
(invoke an Implicit
Deny).
End
Perform action
(permit or deny).
End
End
Test the packet against
criteria in second ACE.
Is there a
match?
Test packet against
criteria in Nth ACE.
Is there a
match?
No
Yes
End
Perform action
(permit or deny).
1. If a match is not found with
the first ACE in an ACL, the
switch proceeds to the next
ACE and so on.
2. If a match with an explicit
ACE is subsequently found,
the packet is either permit-
ted (forwarded) or denied
(dropped), depending on
the action specified in the
matching ACE. In this case
the switch ignores all sub-
sequent ACEs in the ACL.
3. If a match is not found with
any explicit ACE in the ACL,
the switch invokes the
Implicit Deny at the end of
every ACL, and drops the
packet.
Note: If the list includes an
ACE configured with Permit
Any forwarding, no packets
can reach the Implicit Deny
at the end of the list. Also,
placing an ACE with Permit
Any forwarding at any point
in an ACL defeats the
purpose of any subsequent
ACEs in the list.
Figure 9-3. The Packet-Filtering Process in an ACL with N Entries (ACEs)
Note The order in which an ACE occurs in an ACL is significant. For example, if an
ACL contains six ACEs, but the first ACE allows Permit Any forwarding, then
the ACL permits all IPv4 traffic, and the remaining ACEs in the list do not
apply, even if they specify criteria that would make a match with any of the
traffic permitted by the first ACE.
For example, suppose you want to configure an ACL on the switch (with an
ID of “Test-02”) to invoke these policies for routed traffic entering the switch:
9-22
