[FAQ]What Is the Relationship Between the permit/deny Rules in an ACL and Those

The traffic policy module permits packets by default. If you just want to block mutual access between network segments, you only need to define the characteristics of the packets to be denied in the ACL. If you add rule permit at the bottom of the ACL, the packets that do not match previous rules will match the last rule. In addition, if the traffic behavior is set to deny, the device discards all packets matching rule permit. As a result, all services are interrupted.