Uniqcli

ACL first-match and shadowing lab

Trace an IPv4 packet through ordered rules and identify rules fully covered by an earlier entry.

Security

ACL first-match and shadowing lab

Trace an IPv4 packet through ordered rules and identify rules fully covered by an earlier entry.

Example inputs · Replace these with your measurements to build your plan.

Up to 50 rules. Ports: *, 443 or 1000-2000; protocol: any/tcp/udp/icmp.

Method, example and sources
  1. Normalize IPv4 prefixes and inclusive destination-port ranges.
  2. Evaluate packet conditions in entered order and stop at the first match.
  3. Apply implicit deny when no rule matches.
  4. Flag a rule only when one earlier rule covers its entire modeled match space.

Worked example. 10.1.2.3 to 192.0.2.5 TCP/443 matches rule 1. Moving an any/any deny above it changes the result to deny and shadows the later permit.

Your planning result

Permit in this rule set

Rules are evaluated in entered order; the first complete match wins.

Matched rule
1
Fully shadowed rules
0
ACL first-match and shadowing lab: detailed result
RuleActionOrder analysis
1permitNot fully covered by one earlier rule
2denyNot fully covered by one earlier rule
  • IPv4, source/destination prefixes and destination ports only. No live policy, stateful sessions, object groups, IPv6 or collective multi-rule shadow proof.

From the catalog

Network Security & Firewalls

Explore related listings, then confirm the exact model requirements against your plan. These listings are not an automatic compatibility or capacity verdict.

Browse network security & firewalls Browse routers & gateways Get help with the specification

How to use this result

An access list is ordered policy, so adding a correct-looking permit at the bottom may change nothing. Use the packet fields to trace a concrete flow through the list, then compare the first matching rule with the intended behavior. The shadow table checks complete coverage by one earlier rule; partial overlaps can still be significant.

What to verify next

The lab accepts IPv4 prefix conditions and destination ports, rather than a vendor configuration file. It has no knowledge of interfaces, zones, connection state, NAT order or dynamic objects. Review both traffic directions and the actual platform policy before deployment. A permit here describes this entered example and does not establish that a network service is reachable.

Worked example

10.1.2.3 to 192.0.2.5 TCP/443 matches rule 1. Moving an any/any deny above it changes the result to deny and shadows the later permit.

ACL first-match and shadowing lab — Uniqcli