Configuring Security Access Control Lists
... All ACLs have an implicit deny entry at the end of the ACL, so, unless you
explicitly permit it, traffic cannot pass. For example, if you want to allow all users
to access a network through the ACE except for those users with particular IP
addresses, then you must deny the particular IP addresses in ...