Hi  @BilginSahin 

The controller will apply the rules one by one, from index 1 to index 3. So the permit rule will take effect first. 

However the network comminication is a 2-way connection. You have to also permit destination networks to the source. 

BilginSahin wrote

Hi,

i have set up a switch acl where the wifi is not allowed to communicate with the lan. that works so far so good. now i'm trying to unlock two mac addresses with a mac group for administrative activities that connect via the wifi for the rest.

unfortunately that doesn't work properly. what about the order of the acl? does the block always have to come first and then the permit?

i hope someone can help me