US Patent 10057291 Comparing networking access control lists

Techniques and solutions are provided for assessing the semantic difference between networking access control lists (ACLs). For example, a semantic difference can be determined between an ACL that is currently deployed on a network device and an ACL that is a candidate for deployment. The semantic difference can be presented to a user to better understand what changes would be made to network traffic flow if the candidate ACL is deployed. The semantic difference can also be used in an automated manner to perform automatic deployment of the candidate ACL.