HP ProCurve 2910al Access Security Manual page 310

IPv4 Access Control Lists (ACLs)
IPv4 Static ACL Operation
Figure 9-3. The Packet-Filtering Process in an ACL with N Entries (ACEs)
Note
9-22
Test a packet against
criteria in first ACE.
Yes
Is there a
match?
No
Test the packet against
criteria in second ACE.
Yes
Is there a
match?
No
Test packet against
criteria in Nth ACE.
Yes
Is there a
match?
No
Deny the packet
End
(invoke an Implicit
Deny).
The order in which an ACE occurs in an ACL is significant. For example, if an
ACL contains six ACEs, but the first ACE allows Permit Any forwarding, then
the ACL permits all IPv4 traffic, and the remaining ACEs in the list do not
apply, even if they specify criteria that would make a match with any of the
traffic permitted by the first ACE.
For example, suppose you want to configure an ACL on the switch (with an
ID of "Test-02") to invoke these policies for routed traffic entering the switch:
Perform action
End
(permit or deny).
Perform action
End
(permit or deny).
Perform action
End
(permit or deny).
1. If a match is not found with
the first ACE in an ACL, the
switch proceeds to the next
ACE and so on.
2. If a match with an explicit
ACE is subsequently found,
the packet is either permit­
ted (forwarded) or denied
(dropped), depending on
the action specified in the
matching ACE. In this case
the switch ignores all sub­
sequent ACEs in the ACL.
3. If a match is not found with
any explicit ACE in the ACL,
the switch invokes the
Implicit Deny at the end of
every ACL, and drops the
packet.
Note: If the list includes an
ACE configured with Permit
Any forwarding, no packets
can reach the Implicit Deny
at the end of the list. Also,
placing an ACE with Permit
Any forwarding at any point
in an ACL defeats the
purpose of any subsequent
ACEs in the list.