The ACL failed because the packet direction and address roles were wrong, and because an explicit permit is needed after the deny statements. Extended ACL syntax follows source first, then destination. To block traffic from 10.0.10.0/26 going to 10.0.20.0/26 on TCP ports 25 and 80, the source must be the 10.0.10.0 subnet and the destination must be the 10.0.20.0 subnet. If those are reversed, the ACL is matching return traffic or the wrong flow. After the denies, a permit ip any any statement is required at the end; otherwise the implicit deny at the end of every ACL blocks all remaining traffic. The permit must not be placed at the beginning, because ACLs are processed top-down and an early permit would bypass the intended denies. Cisco CCNA v1.1 Security Fundamentals includes ACL behavior, direction, and ordering. The operational fix is therefore to swap source/destination and add the final permit.