Hello Group-Members,
it's really strange but since setting up new access-lists (I never used them before) I noted that the lists stops working after 24h after applying it on the interface. This happens on a C9200L with IOS XE 17.3.7 (and on an elder C4500X).
My lists look like this:
ip access-list extended 111
remark packets on port 22,80,443 from host (10.0.0.10) to server (10.0.0.11) allowed
permit tcp host 10.0.0.10 range 0 65535 host 10.0.0.11 eq 22
permit tcp host 10.0.0.10 range 0 65535 host 10.0.0.11 eq 80
permit tcp host 10.0.0.10 range 0 65535 host 10.0.0.11 eq 443
remark only established connections from server to host allowed
permit tcp host 10.0.0.11 eq 22 host 10.0.0.10 range 0 65535 established
permit tcp host 10.0.0.11 eq 80 host 10.0.0.10 range 0 65535 established
permit tcp host 10.0.0.11 eq 443 host 10.0.0.10 range 0 65535 established
deny ip any any
The Interface of the server (10.0.0.11) looks like this:
interface GigabitEthernet1/0/11
description Server with IP 10.0.0.11
switchport access vlan 11
switchport mode access
switchport port-security violation restrict
switchport port-security mac-address-sticky
switchport port-security
ip access-group 111 in
spanning-tree portfast
The Interface of the Host (10.0.0.10) has no ip access-group entry.
After setting
ip access-group 111 in
the connection works for 24h (reproducible), then it stops. No access to the serverports 22,80,443 is possible anymore.
By reapplying it via:
no ip access-group 111 in
and
ip access-group 111 in
It's working for the next 24h...
Maybe it has something to do with the "established" part of the rule... but why in the world it stops from working after 24h ????
And why does it work after reapplying? If the rule is wrong the ACL should not work a second....
Any hints are welcome, thanks.
