2960G strange behaviour

salemmahara · ‎08-19-2018

Hello all

We have one 2960G. We applied an inbound ACL on a port of that :

deny udp any any eq 53

permit ip any any

it's working fine. But there isn't any match hint for Deny ACE, Permit ACE has however!

Sho ip access-list

deny ........

permit .....(456454 matches)

It's working but without match hint for first line!

balaji.bandi · ‎08-19-2018

deny udp any any eq wq ( what is wq ?)

BB

***** Rate All Helpful Responses *****

How to Ask The Cisco Community for Help

salemmahara · ‎08-19-2018

lo Balaji

That was an example.

We're blocking udp 53

Julio E. Moisa · ‎08-19-2018

Hi

What are you denying?

>> Marcar como útil o contestado, si la respuesta resolvió la duda, esto ayuda a futuras consultas de otros miembros de la comunidad. <<

salemmahara · ‎08-19-2018

udp 53

first post is edited

paul driver · ‎08-20-2018

Hello

And you can confirm UDP 53 is in fact being denied?

show ip accounting access-violations ( if enabled), Also amend the ace of the acl to incorporate log or log-input

access-list 100 deny udp any any eq 53 log-input

Please rate and mark as an accepted solution if you have found any of the information provided useful.
This then could assist others on these forums to find a valuable answer and broadens the community’s global network.

Kind Regards
Paul

salemmahara · ‎08-20-2018

Hello Paul

Yes I'm sure because when we apply acl, dns queries won't work. but when we remove acl from interface it works.

accounting violation is not enabled on interface.

sivam siva · ‎08-20-2018

Hi

When we configure access-list isn't mean that device filter the packets,its just for identify,

packets are filtered when we apply that ACL under interface.

salemmahara · ‎08-26-2018

Hi Sivam

You're right. But in this case, ACL is already applied to the interface.