Access lists

An access list is a traffic selection object that

  • identifies and selects traffic to which a service will apply

  • is used when configuring features such as route maps for Firewall Threat Defense devices, and

  • distinguishes between allowed and blocked traffic, where blocked traffic is excluded from the service but not necessarily dropped altogether.

Types of access lists

You can configure these types of ACL:

  • Extended: Identifies traffic based on source and destination address and ports. Supports IPv4 and IPv6 addresses, which you can mix in a given rule.

  • Standard: Identifies traffic based on destination address only. Supports IPv4 only.

Each access list is composed of one or more access control entries (ACEs), or rules. The order of ACEs is important.

  1. When the ACL is evaluated, a packet is tested against each ACE in the order listed.

  2. After a match is found, no more ACEs are checked.

  3. Place more specific rules at the top of an ACL for correct behavior.

Place the most specific rules at the top of the ACL so it works as expected