[Day 10] 3. Golden Rules of ACL

1. "Whatever not matching with the access list will be discarded. Therefore, there should be at least one permit statement in the access list."

• Explanation: By default, ACLs have an implicit "deny all" rule at the end. This means any traffic not explicitly permitted by the ACL is automatically blocked. Therefore, if no permit rule is specified, all traffic will be denied by default. It is crucial to include at least one permit rule to allow legitimate traffic.
• Example: If you create an ACL without a permit statement, all traffic will be denied because the ACL ends with an implicit "deny all."

2."Specific statements should be applied at the top. Order of statements matter here. Generalized statements should come at bottom."

• Explanation: ACLs are processed top-down; once a packet matches a rule, no further rules are checked. Therefore, more specific rules should be placed at the top to ensure that critical traffic is handled correctly. Generalized rules, which match a broader range of traffic, should be placed at the bottom to avoid prematurely matching packets that should be handled by specific rules.
• Example: If you want to block traffic from one IP but allow the rest, the block rule for that specific IP should come first, and the permit rule for all others should follow.

3."Only one access list per protocol per interface per direction is allowed."

• Explanation: On a router interface, you can apply only one ACL for each protocol (e.g., IP) in each direction (inbound or outbound). You cannot have multiple ACLs for the same protocol in the same direction on the same interface. If multiple ACLs are needed, they must be consolidated into a single ACL.
• Example: If you are applying an ACL to control inbound IP traffic on an interface, only one inbound IP ACL can be applied. You cannot apply both a standard and an extended ACL on the same interface for the same direction.

Note: It's always better to clear the traffic near the source. It is not always true though. Not mandatory, you should use your own logic.