Access-List limitations on ASR920

[Ronit Bhattacharjee]

We have multiple Layer 2 MPLS networks deployed with Cisco ASR920 routers. We have issues matching/denying traffic on ACLs. We tried 3 options
1. Applying the ACL inbound on the physical interface closest to the source - Doesn't match anything

2. Applying the ACL inbound on the service-instance inside the physical interface closest to the source - Clashes with QoS on the physical interface

3. Applying the ACL inbound on the "interface bdi" matches traffic only sourced from a local physical interface, not coming inbound via a pseudowire

I have attached a diagram which shows all three scenarios. 

[paul driver]

Hello

---

@Ronit Bhattacharjee wrote:

3. Applying the ACL inbound on the "interface bdi" matches traffic only sourced from a local physical interface, not coming inbound via a pseudowire

---

Can you confirm if the ACL is a extended access list?

[Ronit Bhattacharjee]

Yes, it is a regular extended Layer 3 ACL matching IPs.

[Ronit Bhattacharjee]

Tested a few more scenarios and the only thing that works is if I apply the ACL on the service instance and remove the QoS service-policy.

[MHM Cisco World]

the traffic is not routing so ACL can not apply here. 
you need some kind of L2 ACL link 
Mac ACL 
port ACL 
Vlan ACL <<- this must be sure that you run VLAN in PW. 

[Ronit Bhattacharjee]

The traffic is Layer 3, routing out of the BD using the "int BDI" on the left side router. In the lab, when I tested the ACL on the physical interface, I generated traffic from the router.

On our projects, we have actually deployed the ACL inbound on the interface bdi, but this works only if the traffic is originated from a local from a local physical interface, not when it is coming over a pseudowire from another router.

[Ronit Bhattacharjee]

Tested a few more scenarios. Looks like, on this platform, with our design, the only way to successfully have ACLs is on the interface inside the service instance. But then you cannot apply a QoS service-policy for marking on the same interface

[mlund]

If your goal is to deny traffic based on acl, then you can do it this way

specify the acl, make a class-map that match the acl, make a policy-map with the just made class-map, in the class-map set qos-group. apply the policy on input interface.

Make a new class-map that match the qos-group from above, make a new policy-map, in the class-map set police <value> conform action drop exceed action drop, apply policy-map to the outgoing interface.

I have done it this way, work as a charm for denying mDNS 

[Ronit Bhattacharjee]

Interesting idea, thanks

[MHM Cisco World]

I think I found the solution here. 
you use Port-ACL ??