| 3.1 |  | Access Control Lists |
| 3.1.4 |  | Processing ACLs |

| ACLs are processed in the order entered in the ACL list - . As a result, administrators should place the frequently hit entries at the top of the list. Adding frequently hit entries to the top of the ACL list will reduce processing time and allow for more effective router management.

Additionally, all ACLs include an implied deny for traffic that is not permitted. A single entry ACL with only one deny entry has the effect of denying all traffic. At least one permit statement must be provided in an ACL or all traffic will be blocked. The two ACLs, 101 and 102 in Figure , have the same effect because of the implied deny.

Figure illustrates the importance of proper ACL placement. In Figure , the last entry is sufficient. The first three entries are not needed because TCP includes Telnet, and IP includes TCP, User Datagram Protocol (UDP), and Internet Control Message Protocol (ICMP).