Cat6500 Inbound ACL Issue. Very strange.

[kfarrington]

Hey everyone :)

So, I have two 6500s and a vlan trunked between them (VLANx)

Running HSRP on the VLANx

6500-1 is 10.10.10.1

6500-2 is 10.10.10.2

HSRP is active on 6500-1 with 10.10.10.3

I have an inbound ACL on both VLANx interfaces, that do not permit anything but UDP traffic.

I can ping and telnet 6500-1 10.10.10.1 ip address

I cannot ping ot telnet 6500-2 10.10.10.2

I cannot ping or telnet 6500-1 10.10.10.3 HSRP

How does that work?

I would have thought, that I would not be able to ping or telnet to any of the interfaces, as it is an inbound ACL?

Is there sommat that happens in the ACL process that says, if you are directly for me, allow it or dont pass it thru the ACL?

Im confused.com :)

Many thx

Ken

[Jon Marshall]

Ken

i suspect Adam has hit it on the head. Inbound on a vlan interface means traffic coming FROM clients on that vlan.

What is more confusing is why 6500_1 works but not 6500_2 or the HSRP address. I'm guessing it's to do with it being a L3 switch and the path that the packets take to enter the 6500 ?.

Perhaps you could do a traceroute to all 3 addresses for us from your client ?

Jon

[adamclarkuk_2]

Do you get a log for the deny to the HSRP VIP ?