There are two types of access lists in Cisco SD-WAN. 

• The first kind is the implicit ACL on transport (TLOC) interfaces. Cisco also calls these rules services. They are there by default and protect the WAN edge router from unwanted traffic coming from the underlay, which is often the Internet.
• The second kind is the explicit ACL, which you build as a localized data policy. You attach it to a specific interface on the WAN edge router, in either the inbound or outbound direction. These explicit ACLs work like the classic IOS ACLs that most network engineers already know from traditional routing.

We apply an explicit ACL per interface on an Edge router in either an inbound or outbound direction. Explicit access lists are just regular ACLs that network engineers have used extensively in traditional IOS routing.