igmp in ISE DACL syntax check fail
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
05-14-2024 09:37 AM
I get a syntax check error when the ISE DACL has permit igmp any 224.0.0.0 15.255.255.255. The ACL is accepted and works on a switch if statically configured. However, ISE syntax check gives the below error. Any suggestions?
"permit igmp any 224.0.0.0 15.255.255.255", argument #2 "igmp" is not valid. Legal option(s):
icmp
ip
tcp
udp
1
4
6
17
- Labels:
-
Identity Services Engine (ISE)
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
05-14-2024 09:44 AM
- Similar to these https://bst.cloudapps.cisco.com/bugsearch?pf=prdNm&kw=argument%20not%20valid%20dacl&bt=custV&sb=anfr&prdNam=Cisco%20Identity%20Services%20Engine%20Software it seems lack of functionality : what ISE version are you on ?
M.
-- Each morning when I wake up and look into the mirror I always say ' Why am I so brilliant ? '
When the mirror will then always repond to me with ' The only thing that exceeds your brilliance is your beauty! '
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
05-14-2024 09:46 AM
only change the igmp with IP
in end you permit IP but this IP is multicast you dont permit any L4 ports
MHM
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
05-14-2024 09:57 AM - edited 05-14-2024 10:00 AM
ISE 3.2 patch 4.
Are you saying to use permit IP any 224.0.0.0 15.255.255.255 instead? I take this is secure because the IGMP IP range is not routable on the public internet, and we don't care about which ports are used, and therefore permitting IP instead of IGMP to this network range allows IGMP traffic but doesn't give end points much of anything else, correct?
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
05-14-2024 10:12 AM
Yoh are correct, let me double check
What is SW platform you have and IOS ver.
MHM
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
05-14-2024 10:16 AM
Version 17.9.4a on C9606R
