IPv4 port range ACL blocked by IPv6 ACL

[Peter __]

Have a Cisco SG350-10 10 on 2.5.5.47

If you make ACL for IPv4 with last rule

Priority                  Action          Logging              Protocol            IP Address  Wildcard Mask   IP Address  Wildcard Mask

2147483647         Deny           Disabled              Any (IP)            Any             Any                    Any              Any

and make a IPv4 rule with TCP port range 5129-5130 allow

then make a IPv6 ACL

Priority          Action           Logging              Protocol          IP Address           IP Address     Flow Label

1                  Permit           Disabled              Any                Any                      Any                Any

Bind for GE2 input ACL your IPv4 and IPv6 rules it blocks port 5130.

[haraldholub]

I have a Cisco SG350X-24PD with firmware 2.5.5.47 and I have exactly the same issue.

IPv4 ACL:

Priority

Action

Logging

Time Range

Protocol

Source IP Address

Destination IP Address

Source Port

Destination Port

Flag Set

DSCP

IP Precedence

ICMP Type

ICMP Code

IGMP Type

Name

State

IP Address

Wildcard Mask

IP Address

Wildcard Mask

...

…

8

Permit

Disabled

TCP

Any

Any

Any

Any

Any

50000-51000

binding that ACL to a port or VLAN will allow connect using the ports in that range

then create an IPv6 ACL:

Priority

Action

Logging

Time Range

Protocol

Source

Destination

Source Port

Destination Port

Flow Label

Flag Set

DSCP

IP Precedence

ICMP Type

ICMP Code

Name

State

IP Address

Prefix

IP Address

Prefix

1

Permit

Disabled

Any

Any

Any

Any

binding both ACLs to the port or VLAN will block the ports in that range.

[haraldholub]

The problem is also with QoS advanced mode when a MAC ACL is used in a class map together with this IPv4 ACL, then mapping to a policy and binding to a port:
For testing I created the following MAC based ACL additionally tot he both ACLs above:
Priority Action Logging Time Range Destination Source VLAN ID 802.1p 802.1p Mask Ethertype
Name State MAC Address Wildcard Mask MAC Address Wildcard Mask
1 Permit Disabled Any Any Any Any
... then creating a class-map:
class-map cmap_test match-any
match ipv4_acl_test
match mac_acl_test
... then adding to a policy map
policy-map pmap_test
class cmap_test
... then binding to a port
interface gi1/0/1
service-policy input pmap_test
... all ports 50000-51000 are blocked; when I remove the MAC basec ACL from the class map, then the ports are being allowed. When I add the IPv6 ACL to the class-map then the ports are blocked again.

[haraldholub]

With the latest firmware release 2.5.8.12 the problem still exists.