If a user creates an ACL rule that consists of only destination aliases and no manually configured destination we should avoid creating firewall rules for the ACL itself (allowing traffic everywhere) and create rules just for the destination aliases