Guidelines for planning the structure of an ACL

After determining the ACL application (VACL or static port ACL) to use at a particular point in your network, determine the order in which to apply individual ACEs to filter IPv6 traffic. After determining the ACL application (RACL, VACL, or static port ACL) to use at a particular point in your network, determine the order in which to apply individual ACEs to filter IPv6 traffic. For information on ACL applications, see IPv6 ACL applications.

The sequence of ACEs is significant.

When the switch uses an ACL to determine whether to permit or deny a packet, it compares the packet to the criteria specified in the individual ACEs in the ACL, beginning with the first ACE in the list and proceeding sequentially until a match is found. When a match is found, the switch applies the indicated action (permit or deny) to the packet.

The first match in an ACL dictates the action on a packet.

Subsequent matches in the same ACL are ignored. However, if a packet is permitted by one ACL assigned to an interface, but denied by another ACL assigned to the same interface, the packet will be denied on the interface.

On any ACL, the switch implicitly denies IPv6 packets that are not explicitly permitted or denied by the ACEs configured in the ACL.

If you want the switch to forward a packet for which there is not a match in an ACL, append an ACE that enables permit any forwarding as the last ACE in an ACL. This ensures that no packets reach the implicit deny case for that ACL.

ACEs listing order

Generally, you should list ACEs from the most specific (individual hosts) to the most general (subnets or groups of subnets), unless doing so permits IPv6 traffic that you want dropped.

For example, an ACE allowing a series of workstations to use a specialized printer should occur earlier in an ACL than an entry used to block widespread access to the same printer.