How to check if a Cisco L3 device is blocking specific socket pair?

[EricLu]

Hi there,

I have a scenario question. Let's say you have one L3 switch. There is an access endpoint - a user laptop connected to the L3 Switch as well as a web server. The laptop and the webserver are on two separate VLANs, and also for good practice, on two separate subnets.

Let's say the user tries to access a website from the web server via port 443 and he/she fails to connect.

Besides watching matches on ACLs, is there a way to see if the failure is happening from within the Switch?

Thanks,

Eric

[Rob Ingram · Accepted solution]

@EricLu take a packet capture on the switch https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst9200/software/release/17-6/configuration_guide/nmgmt/b_176_nmgmt_9200_cg/configuring_packet_capture.html

Or configure port mirror so you can use wireshark to see the traffic.

[EricLu]

Thanks for this reply,

I was looking for more of a debugging command or show command. Something that can be tracked within the Cisco iOS command, as I believe the packet capture will rely on another endpoint to get a port mirror.

[Rob Ingram · Accepted solution]

@EricLu the embedded packet capture on the switch itself does not need a port mirror.

Or an alternative suggest is to run a port mirror of the interface of the client (source).

These are 2 different suggestions and can be run independently.