implicit permit at the end of ACL

TTTony · Created Mar 28, 2018 17:22:07

hello if you configure the acl in vty . the default is deny. if you configure the acl to deny the traffic . the default is permit

chenhui · Created Sep 26, 2021 03:48:51

It's not much easy.
For the ACL different applications, the default action might be different.

fuzi_yao · Created Sep 27, 2021 00:51:05

Hi george2018,
I noticed your question. The description about HCIA and our product manual is correct. ACLs are classified into software ACLs and hardware ACLs. If a software ACL is used, the default action is deny. If a hardware ACL is used, the default action is permit. The differences between software ACLs and hardware ACLs are described as follows:
Software-based ACL: filters the interactive protocol packets destined for the local device, which must be sent to the CPU, for example, FTP, TFTP, Telnet, SNMP, HTTP, routing, and multicast protocol packets.

Hardware-based ACL: filters all packets by delivering ACL resources. Such ACLs include the ACL referenced by a traffic policy or simplified traffic policy, reflective ACL, user group ACL, and ACL for adding outer VLAN tags to the packets received on interfaces.

The software-based and hardware-based ACLs are different in the following aspects:
They filter different types of packets. A software-based ACL filters the packets that must be sent to the CPU for processing, whereas a hardware-based ACL filters all packets.

They filter packets in different ways. A software-based ACL is referenced by upper-layer software to filter packets, which consumes CPU resources. A hardware-based ACL is delivered to hardware for packet filtering, which consumes hardware resources. Packet filtering is faster using a hardware-based ACL.

They take different actions on the packets that match no ACL rule. When packets do not match any ACL rule, a software-based ACL rejects the packets, whereas a hardware-ACL permits the packets.

jumbox · Created Oct 7, 2021 09:40:12

Posted by chenhui at 2021-09-26 03:48 It's not much easy.For the ACL different applications, the default action might be different.

please refer to the huawei documents...and share it with us please

jumbox · Created Oct 11, 2021 12:00:08

I think there is miss understanding...I was talking about down belove situation.
Tested on AR series routers...
acl number 3000
rule 10 permit ip source x.x.x.0 0.0.0.255 destination y.y.y.0 0.0.0.255

--------->there is a implicit permit at the end(as permit ip)
int ge0/0/0
traffic-filter outbound acl 3000

acl number 3000
rule 10 permit ip source x.x.x.0 0.0.0.255 destination y.y.y.0 0.0.0.255
-----> Now when it is applied to the policy as a match statement there is a implicit deny at the end of acl (as deny ip)

traffic classifier testclass operator or
if-match acl 3000 <-----

traffic behavior testpermit
permit
traffic behavior testdeny
deny

traffic policy testpc
classifier testclass behavior testpermit
classifier default-class behavior testdeny

int ge0/0/0
traffic-policy testpc outbound
Thanx

implicit permit at the end of ACL

Third Party’s Trade Secret

My Followers

Enterprise

Consumer

Corporate

Carriers

implicit permit at the end of ACL

Third Party’s Trade Secret

My Followers