ACL

standard, extended, and global

1) compared to interface ACL until find a match

2) compared to global ACL until find a match

3) implied deny