ACL counters not incrementing on ISR 4300

[Justin Reeve]

Hi,

 I have a Cisco ISR 4300 running isr4300-universalk9.03.13.01.S.154-3.S1-ext.SPA.bin. We can see the counters (pkts output/bytes output) for the class-map incrementing but not in the actual ACL. Is this because your unable to see Matches against ACL bound to Class-maps as per CSCtj33068  ? 

MY-ISR#show ip access-lists MULTIMEDIA
Extended IP access list MULTIMEDIA
    10 permit ip 10.58.0.0 0.0.255.255 62.109.192.0 0.0.63.255
    20 permit ip 10.58.0.0 0.0.255.255 64.68.96.0 0.0.31.255
    30 permit ip 10.58.0.0 0.0.255.255 66.114.160.0 0.0.15.255
    40 permit ip 10.58.0.0 0.0.255.255 66.163.32.0 0.0.15.255
    50 permit ip 10.58.0.0 0.0.255.255 66.163.46.0 0.0.1.255
    60 permit ip 10.58.0.0 0.0.255.255 114.29.192.0 0.0.31.255
    70 permit ip 10.58.0.0 0.0.255.255 173.243.0.0 0.0.15.255
    80 permit ip 10.58.0.0 0.0.255.255 208.8.81.0 0.0.0.255
    90 permit ip 10.58.0.0 0.0.255.255 209.197.192.0 0.0.31.255
    100 permit ip 10.58.0.0 0.0.255.255 210.4.192.0 0.0.15.255
    110 permit ip 10.206.58.0 0.0.0.255 62.109.192.0 0.0.63.255
    120 permit ip 10.206.58.0 0.0.0.255 64.68.96.0 0.0.31.255
    130 permit ip 10.206.58.0 0.0.0.255 66.114.160.0 0.0.15.255
    140 permit ip 10.206.58.0 0.0.0.255 66.163.32.0 0.0.15.255
    150 permit ip 10.206.58.0 0.0.0.255 66.163.46.0 0.0.1.255
    160 permit ip 10.206.58.0 0.0.0.255 114.29.192.0 0.0.31.255
    170 permit ip 10.206.58.0 0.0.0.255 173.243.0.0 0.0.15.255
    180 permit ip 10.206.58.0 0.0.0.255 208.8.81.0 0.0.0.255
    190 permit ip 10.206.58.0 0.0.0.255 209.197.192.0 0.0.31.255
    200 permit ip 10.206.58.0 0.0.0.255 210.4.192.0 0.0.15.255

MY-ISR$-map interface gig0/0/0.4094 output class MULTIMEDIA
 GigabitEthernet0/0/0.4094
 
  Service-policy output: CIRCUIT_POLICY

      Match: access-group name MULTIMEDIA
          Queueing
          queue limit 64 packets
          (queue depth/total drops/no-buffer drops) 0/0/0
          (pkts output/bytes output) 176233/94492816

Thanks

J

[TDF]

Frustrating isn't it?

I opened a case for this and was provided the following solution which worked for me.

1)      Remove/detach ALL QoS service policies from ALL targets.

2)      Re-apply the counter configuration commands: (regardless, even if they were already run)

             platform qos match-statistics per-filter

             platform qos match-statistics per-ace

3)      Re-attach the QoS service policies.

# show ip access-lists

Hope that helps.

(I am back on the forums because the counters for my ACL used for wccp redirect are not working)

-T