What is an ACL?

An access control list (ACL) is a named, ordered set of rules that match network traffic against Layer 2 through Layer 7 criteria – addresses, ports, and protocols – and apply an action, such as permit, deny, or reject, to matching packets. Routers, switches, and firewalls evaluate the rules in sequence, stopping at the first match.

Key takeaways

• ACLs match traffic by Layer 2–7 criteria and apply permit, deny, or reject.
• Rules are evaluated in order; the first match wins and evaluation stops.
• Standard ACLs filter by source address; extended ACLs add more criteria.
• ACLs are stateless – each packet is checked with no connection awareness.
• Versa VOS devices apply ACLs at Layer 2 and Layer 3 via NPU hardware.

On this page: Why it matters · How it works · Types · ACL & Versa · FAQ

Why is an ACL important?

An ACL remains foundational to network security because it does one thing extremely well: a router, switch, or firewall reads packet headers, checks them against an ordered rule list, and permits or drops the packet before it consumes further compute. That evaluation runs in hardware, so ACLs scale to line rate on silicon that would choke on stateful inspection.

ACLs also give administrators the coarsest, most explicit layer of control: interface-level rules deciding what traffic may even enter a segment, before any application-aware policy runs. That makes them a first line of defense – segmenting VLANs, blocking known-bad address ranges – and a building block underneath more sophisticated controls, since many firewall features resolve to an ACL-style rule.

What is an ACL?

An ACL is a named or numbered list of rules, each specifying match conditions and an action. Conditions inspect Layer 2 fields (MAC address, VLAN), Layer 3 fields (source and destination IP address), and Layer 4 fields (protocol, ports). The action on a match is typically permit, deny, or reject; some platforms add counting, service-engine redirection, or rate-limiting via a policer.

Rules are evaluated top-down, stopping at the first match – order determines the outcome, so specific rules go above broader ones. Most implementations end with an implicit deny: unmatched packets drop by default, so an ACL must explicitly permit the traffic it intends to allow. ACLs are stateless – each packet is checked independently, with no memory of prior packets, which separates an ACL from a stateful firewall policy.

Types of ACLs

Implementations vary by vendor, but most fall into a few categories. Standard ACLs match only source address, offering coarse control – permit or deny an entire network in one rule. Extended ACLs add destination address, protocol, and port matching, letting a rule permit HTTPS from one host to one server, not an entire subnet. Named ACLs identify the list by name instead of a number, easing edits and audits. A separate axis is scope: Layer 2 ACLs match Ethernet fields such as MAC address and VLAN, while Layer 3/4 ACLs match IP addresses, protocols, and ports – Versa’s NPU hardware evaluates both together.

ACL & Versa

Versa implements ACLs at two configuration surfaces. On VOS appliances with NPU switching hardware – the CSG3000, CSX4000, and CSG5000 series – NPU ACL policies filter traffic in fast-path silicon, before it reaches the CPU. Each tenant configures one Layer 2 ACL policy and up to two Layer 3 IPv4 policies (single-wide and double-wide, differing in TCAM memory and port-range matching), plus one Layer 3 IPv6 policy. Rules match MAC and IP addresses, DSCP, and ICMP type; the action can permit, deny, count, or redirect the packet to the CPU for antivirus filtering. A QoS profile can attach a policer to rate-limit matching traffic.

On Versa CSX switches, SD-LAN ACL policies are built through the Director workflow wizard and applied to switch ports via a port profile.

Frequently asked questions

What is the difference between standard and extended ACLs?

Standard ACLs match only source address, giving coarse allow/deny control over an entire network in one rule. Extended ACLs add destination address, protocol, and port matching, letting a rule permit or deny one specific application flow between two hosts, not a whole subnet.

What is the difference between an ACL and a firewall?

An ACL evaluates each packet independently against a static rule list – it has no memory of prior packets. A stateful firewall tracks connections and automatically permits return traffic for an already-allowed session, needing far fewer rules than an equivalent ACL-only setup.

What happens to traffic that matches no ACL rule?

Most ACL implementations end with an implicit deny: any packet matching none of the configured rules is dropped by default. That is why an ACL must explicitly permit every pattern it is meant to allow, not just the traffic it intends to block.

Does rule order matter in an ACL?

Yes. Rules are evaluated top-down, and processing stops at the first match, so a broad rule placed above a specific one can silently shadow it and produce the wrong outcome. Administrators order rules from most specific to least specific to avoid unintended matches.

Can an ACL rate-limit traffic instead of just permitting or denying it?

Yes, on platforms that support it. Versa’s NPU ACL rules can associate a QoS profile that applies a policer, evaluating committed and peak information rates, so traffic beyond the configured rate is marked and dropped instead of simply passed or blocked.

More on ACL

If you want to learn more, these are sources we trust.

Related terms

If you’re reading about ACL, these are worth looking at next.