Technical information

ADC Telecommunications, Inc.
412 C
HAPTER 14: IP PACKET FILTERING
Packet Filtering Considerations
When creating packet filters, consider these points:
■ Access lists contain an implicit deny at the end. This means packets for
which no match is found are rejected. When more than one access list is
applied to an interface, non-matching packets are compared to the
access-list with the next highest priority. If a match is still not found, the
packet is matched against the next access list. If, after applying the
packet to the final access list on an interface, a match is not found the
packet is dropped.
■ The sequence in which an inbound or outbound packet is matched
against the filter criteria of an interface is determined by the following:
■ Rule number within access list — Lower rule numbers take precedence
over higher rule numbers. This means that within an access list, the
rule with the lower number is examined first.
■ Priority of access-list within the access class — When you apply an
access-list to an interface, access lists assigned lower priorities take
precedence over lists assigned higher priorities. This means that within
an access class, the access list with the lower number is examined first.