For a conventional ordered Cisco IOS extended IP access list, read the entries in sequence and stop at the first match. A later, more specific-looking entry does not override an earlier matching rule. If no entry permits the packet, the implicit deny at the end becomes important.
Cisco’s IP access-list configuration guide explains matching and interface direction. These examples describe ordered extended IP ACL behavior; do not transfer every detail to another platform or ACL type without checking its rules.
An original three-rule exercise
Imagine an ACL applied to the relevant traffic path with these ordered intentions:
- Permit TCP from 192.168.20.0/24 to host 10.0.0.10 on destination port 443.
- Deny all other IP traffic from 192.168.20.0/24 to 10.0.0.0/24.
- Permit other IP traffic.
Now trace a TCP packet from 192.168.20.15 to 10.0.0.10, destination port 443. It matches rule one and is permitted. Processing does not continue to rule two to reverse that result.
Change only the destination port to 22. Rule one no longer matches; rule two does. The packet is denied. Rule three cannot rescue it because a previous entry already decided the result.
Change the source to 192.168.30.15. Under the simplified rule set, neither of the first two entries matches the source range, so the third entry permits the packet.
Order can change the outcome
Move the broad deny above the HTTPS permit. The original HTTPS packet now matches the deny first. A carefully written exception placed after a matching broad rule cannot do its intended job.
That is why reviewing an ACL as an unordered list of permitted and denied services is unreliable. The question is not merely whether a permit exists somewhere. It is whether the packet reaches that permit before another matching entry.
Use the CCNA access-list practice questions to practice explaining the first matching entry. In your own notes, include the source, destination, protocol and relevant port so the explanation remains testable.
Direction belongs to the interface
“Inbound” and “outbound” describe the direction relative to the interface where the ACL is applied. Draw an arrow for the packet before interpreting the label. Traffic leaving a user’s computer may still be entering a router interface.
Return traffic is another separate consideration. A basic stateless ACL does not become stateful merely because one direction of a connection was permitted. Avoid assuming the reverse path follows the same entries with the same source and destination roles.
Review the miss, then alter one field
If you selected the wrong outcome, identify the exact mismatch: source range, destination, protocol, port, entry order or interface direction. Then change only that field in a new example. The CCNA security concepts study guide provides a place to reconnect access lists with the broader security material.
A correct answer is strongest when you can name the deciding entry and explain why the entries above it did not match. That habit is more reliable than choosing the answer that contains the most familiar service name.