TROUBLESHOOT ACLs

TROUBLESHOOT ACLs

1. Processing Packets with ACLs

   • If the frame address is accepted, the frame information is stripped off and the router checks for an ACL on the inbound interface. If an ACL exists, the packet is tested against the statements in the list.
     • If the packet matches a statement, the packet is either permitted or denied. If the packet is accepted, it is then checked against routing table entries to determine the destination interface.
       • If a routing table entry exists for the destination, the packet is then switched to the outgoing interface, otherwise the packet is dropped.
         • If the packet matches a statement, it is either permitted or denied. If there is no ACL or the packet is permitted, the packet is encapsulated in the new Layer 2 protocol and forwarded out the interface to the next device.

2. Troubleshooting Standard IPv4 ACLs - Example 1

   • Using the show commands described earlier reveals most of the more common ACL errors
   • When viewing the output of the show access-list command, only PC2 is explicitly denied. However, there is no permit statement allowing other access.
   • All access out the G0/0 interface to the 192.168.30.0/24 LAN is currently implicitly denied. Add a statement to ACL 10 to permit all other traffic
     • PC1 should now be able to access the file server. Output from the show access-list command verifies that a ping from PC1 to the File Server matches the permit any statement.

3. Troubleshooting Standard IPv4 ACLs - Example 2

   • • When viewing the output of the show access-list command, you can see that PC2 is matching the deny statement. ACL 20 seems to be configured correctly. You suspect that it must be incorrectly applied and view the interface configurations for R1
       • the show run command filtered to view the interface configurations reveals that ACL 20 was applied to the wrong interface and in the wrong direction. All traffic from the 192.168.11.0/24 is denied inbound access through the G0/1 interface.
         • To correct this error, remove ACL 20 from the G0/1 interface and apply it outbound on the G0/0 interface, as shown in Figure 3. PC2 cannot access PC1, but can now access the Internet.

4. Troubleshooting Standard IPv4 ACLs - Example 3

   • PC1 is unable to remotely access R1 using an SSH connection. Viewing the running configuration section for the VTY lines reveals that an ACL named PC1-SSH is correctly applied for inbound connections. The VTY lines are correctly configured to only allow SSH connections. From the output of the show access-list command, you notice that the IPv4 address is the G0/0 interface for R1, not the IPv4 address of PC1
     • the statement that needs to be corrected is the first statement, we use the sequence number 10 to delete it by entering no 10. We then configure the correct IPv4 address for PC1. The clear access-list counters command resets the output to only show new matches. An attempt from PC2 to remotely access R1 is successful, as shown in the output for the show access-list command.

Images and files in the map