%SEC-6-IPACCESSLOGRP: list xxx denied igmp 0.0.0.0

[faika]

Dear all,

I've placed an acl on an interface which only allow a specific segment to pass through. I'm not running igmp/multicast but receive such message in the log:

%SEC-6-IPACCESSLOGRP: list xxx denied igmp 0.0.0.0 -> 224.0.0.2, 2 packets

Any thought ?

Many Thanks,

Dicky Wong

[jolmo]

This is what Cisco says about this error:

%SEC-6-IPACCESSLOGRP: list [chars] [chars] [chars] [IP_address] [chars]-> [IP_address], [dec] packet[chars]

A packet matching the log criteria for the given access list has been detected.

Recommended Action: No action is required.

Are you running HSRP? so the multicast address 224.0.0.2 is also used to send HSRP hello messages.

HTH

[faika]

Hi jolmo,

Yes, I'm running HSRP on two 3750s with virtual vlans, Shall I allow it to pass through in the ACL or the HSRP can have other methods to send hello messages ?

Thanks,

Dicky Wong

[Prashanth Krishnappa]

224.0.0.2 is for "All Routers on this Subnet" and not just used by HSRP. From the message it appears to be IGMP related and it is sourced from 0.0.0.0. What does your ACL look like?

[faika]

Hi,

Oops. Just recap, I'm not running HSRP on this particular interface, but do on other virtual interfaces.

Here's the info. I've 4 x 3750 in two stacks, Both running on OSPF same area and HSRP on virtual vlan.

I'm using 172.16.0.0/24 for Router ID and Loopback inteface. Both 192.168.1.225/29 and 172.16.0.0/24 is in same ospf area.

interface VlanXX (without hsrp)

description #1

ip address 192.168.1.225 255.255.255.248

ip access-group 161 in

no ip redirects

no ip mroute-cache

interface Loopback0

description XXX OSPF Router ID

ip address 172.16.0.252 255.255.255.255

ip subnet-zero

no ip source-route

ip routing

ip classless

router ospf 100

log-adjacency-changes

redistribute static subnets

passive-interface default

network 192.168.1.224 0.0.0.7 area XXX

network 172.16.0.0 0.0.0.255 area XXX

permit ip any 192.168.1.224 0.0.0.7 (641 matches)

permit ip 192.168.1.224 0.0.0.7 any (22 matches)

deny ip any any log (3306 matches)

VlanXX is up, line protocol is up

Internet address is 192.168.1.225/29

Broadcast address is 255.255.255.255

Address determined by non-volatile memory

MTU is 1500 bytes

Helper address is not set

Directed broadcast forwarding is disabled

Multicast reserved groups joined: 224.0.0.5 224.0.0.6

Outgoing access list is not set

Inbound access list is 161

Proxy ARP is enabled

Local Proxy ARP is disabled

Security level is default

Split horizon is enabled

ICMP redirects are never sent

ICMP unreachables are always sent

ICMP mask replies are never sent

IP fast switching is enabled

IP fast switching on the same interface is disabled

IP Flow switching is disabled

IP CEF switching is enabled

IP CEF Feature Fast switching turbo vector

IP multicast fast switching is disabled

IP multicast distributed fast switching is disabled

IP route-cache flags are Fast, CEF

Router Discovery is disabled

IP output packet accounting is disabled

IP access violation accounting is disabled

TCP/IP header compression is disabled

RTP/IP header compression is disabled

Probe proxy name replies are disabled

Policy routing is disabled

Network address translation is disabled

WCCP Redirect outbound is disabled

WCCP Redirect inbound is disabled

WCCP Redirect exclude is disabled

BGP Policy Mapping is disabled

VlanAA is up, line protocol is up (with hsrp)

Internet address is 192.168.1.131/27

Broadcast address is 255.255.255.255

Address determined by non-volatile memory

MTU is 1500 bytes

Helper address is not set

Directed broadcast forwarding is disabled

Multicast reserved groups joined: 224.0.0.2 224.0.0.5 224.0.0.6

Outgoing access list is not set

Inbound access list is not set

Proxy ARP is enabled

Local Proxy ARP is disabled

Security level is default

Split horizon is enabled

ICMP redirects are never sent

ICMP unreachables are always sent

ICMP mask replies are never sent

IP fast switching is enabled

IP fast switching on the same interface is disabled

IP Flow switching is disabled

IP CEF switching is enabled

IP CEF Fast switching turbo vector

IP multicast fast switching is disabled

IP multicast distributed fast switching is disabled

IP route-cache flags are Fast, CEF

Router Discovery is disabled

IP output packet accounting is disabled

IP access violation accounting is disabled

TCP/IP header compression is disabled

RTP/IP header compression is disabled

Probe proxy name replies are disabled

Policy routing is disabled

Network address translation is disabled

WCCP Redirect outbound is disabled

WCCP Redirect inbound is disabled

WCCP Redirect exclude is disabled

BGP Policy Mapping is disabled