MAFs allow actions to permit or deny (or use the deny-host-unreachable response for IP filters) traffic.