An ACL is often used with a traffic policy. A traffic policy defines the traffic classifier matching an ACL and a traffic behavior such as permit/deny associated with the traffic classifier.

        The permit/deny actions in an ACL and a traffic behavior in the traffic policy are used as follows.

        A switch permits packets by default. To reject packets between subnets, define the packets to be rejected in the ACL. If the rule permit all command is used, all packets match the rule. If the traffic behavior defines the deny action, all packets are filtered, causing service interruption.