how to troubleshoot ACL's..

[ashok_boin]

Hi,

Let's take a simple scenario...

A - R1 - R2 - R3 ... - Rn - B

A is a client and B is a server and Rx are Cisco routers in between.

Assuming that we have received a complaint just like this.

A is not able to connect to B server on port UDP/1400 but able to ping.

There are ACL's in each n every router along the path. So, in this case, how can we quickly analyze (without going by router and router to check manually) where the packets are dropping and on which router?

I have ruled out the options to use extended ping or telnet with src interface option, as I cann't use them perfectly to test the communication between Source A and Destination B except the edge routers.

I would like to know a tip or any networking tool which tells us about the router where packets are dropping.

Thanks in advance..

Regards...

-Ashok.

[dgahm]

You could configure all routers to log all dropped packets to a syslog server, then search the log for the address you are troubleshooting.

You will need an explicit deny any at the end of your ACLs.

access-list 150 deny ip any any log

logging 10.1.1.1 (address of syslog server)

[ashok_boin]

Suggestion is excellent. Thank you very much.

I feel it is very daunting task to add this entry on each inbound and outbound interface of routers (for eg 12 routers).