Extended Named ACL Denying Traffic

[tonyplueard]

I have the following ACL. For the most part everything is working in the ACL as it should be. The problem is that even though 192.168.203.0 is permitted, I still get denies in the logs. The logs will be below the ACL. We switched from TCP to IP in the ACL and now we are no longer getting the denies but I don't understand why it was getting denied.

ip access-list extended veneer-203

permit tcp host 192.168.244.20 10.2.203.0 0.0.0.255 eq 80
permit tcp host 192.168.244.25 10.2.203.0 0.0.0.255 eq 80
permit tcp host 192.168.244.30 10.2.203.0 0.0.0.255 eq 80

permit tcp 192.168.203.0 0.0.0.255 10.2.203.0 0.0.0.255 eq 80 established
permit tcp 192.168.203.0 0.0.0.255 10.2.203.0 0.0.0.255 eq 443 established
permit tcp 192.168.203.0 0.0.0.255 10.2.203.0 0.0.0.255 eq 554 established

deny ip any any log

Jul 10 14:30:14 PDT: %SEC-6-IPACCESSLOGP: list veneer-203 denied tcp 192.168.203.45(64656) -> 10.2.203.52(80), 1 packet
Jul 10 14:30:24 PDT: %SEC-6-IPACCESSLOGP: list veneer-203 denied tcp 192.168.203.45(64671) -> 10.2.203.52(443), 1 packet
Jul 10 14:30:34 PDT: %SEC-6-IPACCESSLOGP: list veneer-203 denied tcp 192.168.203.45(64709) -> 10.2.203.51(443), 1 packet
Jul 10 14:31:04 PDT: %SEC-6-IPACCESSLOGP: list veneer-203 denied tcp 192.168.203.45(64729) -> 10.2.203.52(80), 1 packet

[MHM Cisco World]

Please what is direction of traffic here 

Are ACL inbound or outbound ?

[tonyplueard]

This is an outbound ACL

[MHM Cisco World · Accepted solution]

ip access-list extended veneer-203 <<-OUTbound 

permit tcp host 192.168.244.20 10.2.203.0 0.0.0.255 eq 80
permit tcp host 192.168.244.25 10.2.203.0 0.0.0.255 eq 80
permit tcp host 192.168.244.30 10.2.203.0 0.0.0.255 eq 80

permit tcp 192.168.203.0 0.0.0.255 10.2.203.0 0.0.0.255 eq 80 
permit tcp 192.168.203.0 0.0.0.255 10.2.203.0 0.0.0.255 eq 443 
permit tcp 192.168.203.0 0.0.0.255 10.2.203.0 0.0.0.255 eq 554 
deny ip any any 

ip access-list extended veneer-203IN <<-INbound

permit tcp 192.168.203.0 0.0.0.255 10.2.203.0 0.0.0.255 eq 80 established
permit tcp 192.168.203.0 0.0.0.255 10.2.203.0 0.0.0.255 eq 443 established
permit tcp 192.168.203.0 0.0.0.255 10.2.203.0 0.0.0.255 eq 554 established

deny ip any any log

this what you need established work only INbound not for OUTbound if the traffic initiate from 192.168.203.x

[tonyplueard]

So are you saying that having the established at the end is what is causing the denies?

[tonyplueard]

Also the ACL is technically an outbound acl but it is an inbound to the 10.2.203.0 VLAN

[MHM Cisco World]

I depend on your answer before you apply this ACL OUTbound under the SVI 
and OUTbound not work  with established.
established work with INbound ACL. 
there is no ACL config as OUTbound and work as OUTbound and INbound. 

[tonyplueard]

I apologize it is an outbound ACL on the SVI

[tonyplueard]

I redid the ACL without the established on it and I have stopped getting all the denies. Thank you for your help and I learned something new.

[MHM Cisco World]

friend You are so welcome any time 
have a nice day 
MHM

[Marius Gunnerud]

@tonyplueard please select a correct answer so to reward @MHM Cisco World for his time and effort.  Selecting correct answers and rating helpful provides points to the experts which in turn will reward the expert with recognition in the Cisco Community.