Is the global rule and the implicit deny following it looked at, even if no explicit interface ACL is configured on the interface?
If you configure a global access rule, then the implicit deny comes after the global rule is processed. See the following order of operations:
Interface access rule.
Global access rule.
Implicit deny.
What if 1. does not exist and only 2. exists?