An implicit deny is a hidden access-control rule at the end of an access control list (ACL). It denies any packet that matches none of the ACL’s explicit access control entries (ACEs). section 23.1.2
ACLs evaluate packets against ACEs from top to bottom. A matching ACE immediately applies its permit or deny action; unmatched traffic reaches the implicit deny and is discarded. section 23.1.1 section 23.1.2
Unmatched traffic is denied
Consider these rules: deny source addresses in 192.168.1.0/24; permit source addresses in 192.168.0.0/16. A packet from 172.16.1.1 matches neither rule, so the implicit deny discards it. The more specific deny must appear first, because a matching permit stops further evaluation. section 23.1.1 section 23.1.2
Remember these operational points:
- Permit only traffic explicitly allowed by the ACL; all other traffic is denied. section 23.1.2
- Creating an ACL alone does not filter traffic; apply it to an interface inbound or outbound. section 23.4
Figure 23.3 A packet is denied by the implicit deny. The packet’s source IP (172.16.1.1) doesn’t match the first ACE (192.168.1.0/24) or the second ACE (192.168.0.0/16), so it is denied by the implicit deny; the router will discard it.
Trace how a packet from 172.16.1.1 misses both explicit ACEs and is discarded by the implicit deny. section 23.1.2
