What Is the Relationship Between the permit/deny Rules in an ACL and Those in the Behavior of a Traffic Policy?

An ACL is usually used with a traffic policy. A traffic policy includes the traffic classifier that meets the requirement of an ACL and a traffic behavior, such as permit/deny.

The permit/deny rules in an ACL and a behavior in the traffic policy are used as follows.

**Table 1** Usage of permit/deny rules in an ACL and in a behavior
ACL	Behavior in a Traffic Policy	Action Taken for Matching Packets
permit	permit	permit
permit	deny	deny
deny	permit	deny
deny	deny	deny

The traffic policy module permits packets by default. If you only want to block mutual access between network segments, you only need to define the characteristics of the packets to be denied in the ACL. If you add rule permit at the bottom of the ACL, the packets that do not match previous rules will match the last rule. In addition, if the traffic behavior is set to deny, the device discards all packets matching rule permit. As a result, all services are interrupted.