ACL

[ryanj88]

I am trying to configure an ACL on my R2 router. I have my network set up and followed along with my assignments, but I am unable to ping the servers. I cannot seem to figure out where I have gone wrong. Could someone please help me?

[David Ruess · Accepted solution]

Hello,

Found a couple of issues:

1 - the servers had different Default Gateways configured than the subinterface on R2 had configured.

2. Check rout routing. I enable EIGRP and once I had full routing I was able to ping from the PCs to the servers.

I didn't check all of it but those 2 things seemed to get functionality. If you need specific connectivity be sure to add that in if you need more help

-David

[vishalbhandari]

Configuring an Access Control List (ACL) on a router can sometimes lead to unintended blocking if not done correctly. Here are some steps to troubleshoot and ensure your ACL configuration allows the desired traffic while blocking unwanted traffic:

Steps to Troubleshoot ACL Configuration: 

1. Check the ACL Rules: Ensure that the ACL rules are correctly defined and in the correct order. ACLs are processed top-down, so the order of the rules is crucial. An implicit "deny all" rule is always at the end of an ACL, which means any traffic not explicitly permitted will be denied.

Example ACL:

arduino

access-list 100 permit ip any any

2. Verify ACL Application: Confirm that the ACL is applied to the correct interface and in the correct direction (inbound or outbound). An ACL applied in the wrong direction or on the wrong interface will not affect the traffic as intended.

Applying an ACL to an interface:

kotlin

interface GigabitEthernet0/0
ip access-group 100 in

3. Check ACL Counters: Use the show access-lists command to check the hit counts on the ACL entries. This helps determine if the traffic is matching any rules.

sql

show access-lists 100

4. Ping Tests and Logs: Perform ping tests and check the router logs for any ACL-related messages. Enable logging for the ACL to capture deny messages, which helps identify which packets are being blocked.

Enable logging for ACL:

r

access-list 100 permit ip any any log

5. Simplify the ACL: Simplify the ACL to a basic permit rule for testing purposes. This helps determine if the issue lies within the ACL rules.

arduino

access-list 100 permit ip any any

6. Interface Configuration: Verify that the interface configurations (IP addresses, subnet masks, etc.) are correct and that the interfaces are up.

kotlin

show ip interface brief

 If after these steps you still can't ping the servers, there might be other issues at play such as routing problems, interface misconfigurations, or other ACLs that might be interfering.

[ryanj88]

Once again, you helped me out. Thank you so much. Once EIGRP was enabled, it worked perfectly.

[David Ruess]

Glad the response was helpful. That usually indicates an issue with routing. I only enable EIGRP to see if the reachability was there. Once I removed EIGRP and the routing relied on the static routes and connectivity was lost. If you keep the static routes make sure to review them and have every router be able to reach all intended destinations