Security - NACLs

Question 1

Default NACL

Answer 1

By default, it allows all inbound and outbound IPv4 traffic and, if applicable, IPv6 traffic.

The default network ACL is configured to allow all traffic to flow in and out of the subnets with which it is associated. Each network ACL also includes a rule whose rule number is an asterisk. This rule ensures that if a packet doesn’t match any of the other numbered rules, it’s denied. You can’t modify or remove this rule.

Question 2

Custom NACL

Answer 2

By default, each custom network ACL denies all inbound and outbound traffic until you add rules.

Question 3

Subnets and NACLs relationship

Answer 3

You can associate a network ACL with multiple subnets; however, a subnet can be associated with only one network ACL at a time.

Question 4

What does stateless NACL mean?

Answer 4

Network ACLs are stateless; responses to allowed inbound traffic are subject to the rules for outbound traffic (and vice versa).