access list works only if word 'log' presents

[Tibor Marchyn]

Hi,

I have very strange behaviour on my Cisco 2801 router when I applied access list on wan interface.

Architecture:

SIP Provider <----> Cisco 2801 <-----> CUCM 6

Problem:

We are using Cisco 2801 as Voice gateway for CUCM 6. so only one purpose of this router is just receiving calls on sip dial-peer and transfering to internal network.

If you look on access list below, if 'log' words don't present on these 2 lines, access list didn't work. Problem with it is that when I establish call from us or to us I can't hear incomming RPT stream, but other side can hear me. But when I type word 'log' there, everything stars working immediately.

So what is problem? Can somebody explain me this behaviour? Is it bug in my current version of IOS?

Thanks

Cisco 2801 IOS version:

Cisco IOS Software, 2801 Software (C2801-ADVENTERPRISEK9_IVS-M), Version 12.4(6)T9, RELEASE SOFTWARE (fc2)

ROM: System Bootstrap, Version 12.3(8r)T8, RELEASE SOFTWARE (fc1)

System image file is "flash:c2801-adventerprisek9_ivs-mz.124-6.T9.bin"

Cisco 2801 (revision 5.0) with 236544K/25600K bytes of memory.

Processor board ID FCZ093621D3

6 FastEthernet interfaces

9 Serial interfaces

2 ISDN Basic Rate interfaces

1 Channelized E1/PRI port

1 Virtual Private Network (VPN) Module

2 Voice FXO interfaces

2 DSPs, 16 Voice resources

DRAM configuration is 64 bits wide with parity disabled.

191K bytes of NVRAM.

62720K bytes of ATA CompactFlash (Read/Write)

Cisco 2801 config:

interface FastEthernet0/1

description VOIP ISP WAN

ip address 111.222.333.444 255.255.255.252

ip access-group voipwan in

no ip redirects

no ip proxy-arp

ip accounting access-violations

ip nbar protocol-discovery

ip virtual-reassembly

duplex auto

speed auto

no cdp enable

no mop enabled

!

ip access-list extended voipwan

permit ip host 1.2.3.4 any log

permit ip 5.6.7.8 0.0.0.7 any log

deny   icmp any any

deny   ip any any

[Nicolas Fournier]

Hi Tibor,

Adding the log keyword causes the traffic matching this entry to bypass CEF and this might explain why it only works when you add it.

Could you try to disable CEF globally and see if you also have this problem?

If it is gone, I would search on the bug toolkit for possible causes that would cause CEF traffic to bypass the ACL matching.

Regards,

Nicolas

[Tibor Marchyn]

I'm new to security so please could you tell me what is CEF and how to disable it?

thanks

[Nicolas Fournier]

Hi Tibor,

CEF stands for Cisco Express Forwarding.

You can find more info on it under the following link:

http://www.cisco.com/en/US/docs/ios/12_1/switch/configuration/guide/xcdcef.html

To disbale it, just type the no ip cef command in config mode.

Regards,

Nicolas

[Tibor Marchyn]

Will have it some impact on performace of router? Or when I have to care about performance if I disable it?

[Nicolas Fournier]

Hi Tibor,

I will have performance impact once disabled but it depends on how much traffic you are passing through your router,

Anyway, you can only disable it for a short amount of time to verify that the problem is due to CEF and if the ACL are working fine without the log keyword once it is disabled, you can start searching for bugs that would describe such behavior.

Regards,

Nicolas

[skyjapcisco]

Hi tibor, did you managed to figure out whether it was a cisco bug? I had the same issue.