Access control lists (ACLs) are used to identify flows. A network device filters packets according to certain rules. It must identify packets first, and then permits or denies the packets according to the configured policy.