System:
Build Information: Built By : ingunawa Built On : Mon Jun 28 01:20:45 PDT 2021 Built Host : iox-ucs-032 Workspace : /auto/iox-ucs-032-san1/prod/7.4.15.02I.DT_IMAGE/iosxrwbd/ws Version : 7.4.15.02I Location : /opt/cisco/XR/packages/ Label : 7.4.15.02I
I am trying to find a way to gather ACL hit counters from a Cisco IOS XR using yang models / netconf, then expand to grpc telemetry.
Here is what my ACL looks like, and its interface application:
#do show run ipv4 access-list testing-hit-counters ipv4 access-list testing-hit-count 12 deny icmp any any #do show run interface HundredGigE 0/0/0/1.3502 Mon Oct 25 13:41:21.692 EDT interface HundredGigE0/0/0/1.3502 ipv4 address 10.35.2.1 255.255.255.0 ipv6 address fdd1:10:35:2::1/64 encapsulation dot1q 3502 ipv4 access-group testing-hit-counters ingress
The command I am using to gather hit counters from CLI is the following, with output
#show ip access-lists ipv4 testing-hit-counters hardware ingress detail location 0/0/CPU0 on Oct 25 13:22:53.856 EDT testing-hit-counters Details: Sequence Number: 12 NPU ID: 0 Number of DPA Entries: 1 ACL ID: 15 ACE Action: DENY ACE Logging: DISABLED ABF Action: 0(ABF_NONE) Hit Packet Count: 2 Protocol: 0x01 (Mask 0xFF) DPA Entry: 1 Entry Index: 0 DPA Handle: 0x8F6231E8
I need to gather "Hit Packet Count:".
Troubleshooting:
- I tried using the Cisco-IOS-XR-ipv4-acl-oper.yang yang model. Note I am using yangsuite to help analyze data / build my rpc calls. I tried pulling all the data from my access-group / sequence number, but I get no hits, here is a image of hte yangsuite model I choose. I see two intersting containers called "hits" and "police-hits"
Here is the output of the netconf grab:<?xml version="1.0" ?> <rpc-reply message-id="urn:uuid:9dfee5cc-090a-419d-9342-5c2fbd0bd37b" xmlns="urn:ietf:params:xml:ns:netconf:base:1.0" xmlns:nc="urn:ietf:params:xml:ns:netconf:base:1.0"> <data> <ipv4-acl-and-prefix-list xmlns="http://cisco.com/ns/yang/Cisco-IOS-XR-ipv4-acl-oper"> <access-list-manager> <accesses> <access> <access-list-name>testing-hit-counters</access-list-name> <access-list-sequences> <access-list-sequence> <sequence-number>12</sequence-number> <hits>0</hits> <police-hits>0</police-hits> </access-list-sequence> </access-list-sequences> </access> </accesses> </access-list-manager> </ipv4-acl-and-prefix-list> </data> </rpc-reply>As you can see "hits" is 0. - I believe this is an issue due to my command syntax includes "hardware" so I believe its trying to gather hardware counters, which this yang model does not support.
- Tried messing with "Cisco-IOS-XR-fib-common-oper" but I was not successful at gathering any hardware hit counters for acl entries.
- I noticed that I can build an ACE "counter" or "log counter", however I have no idea how I can access that information. The only way I have been able to access ACL hit counters is with the above command I shared. Is there another way to count ACL hits? Here is what my changes look like, but I cant seem to figure out where the "counter" goes to or where its logged:
Change01:ipv4 access-list testing-hit-count 12 deny icmp any any counter please-countme
Change02:ipv4 access-list testing-hit-count 12 deny icmp any any log counter log-counter
Any recommendations? Is there a yang file I am just not aware of that can gather the Hit Packet Count I need?
