Dears,
when I had an issue troubleshooting, i noticed that ACLs count for ICMP messages twice as they are, is that real behlavour and why?, or I have a loop in my network?
My topology was two dircet Switches (SW2 & SW4) connected directly to each other using L3 port-channel, i setup ACL on SW4 states as the following
SW4:
access-list 101 permit icmp any any
access-list 101 permit ip any any
int port1
access-group 101 in
no sw
ip add 1.1.1.4 255.255.255.0
SW2
int port1
no sw
ip add 1.1.1.2 255.255.255.0
then i issued ping 1.1.1.4 repe 1 from SW2, then when i hit show ip access-list, I found 2 matches in the show access-list command, is that normal? or was it a loop? or does it count for incoming and outgoing packets although it is applied only once and in one direction ??
to make sure it doesn't count for both income and outgoing packets, I've changed the first sequence of the ACL to be: access-list 101 permit icmp host 1.1.1.2 any, and it still counts the double..
I also noticed that after I spcifified source of ICM in the ACL , the switch starts to show logging event says: "administratively prohibited unreachable message sent to 1.1.1.2", even if there is no pings, what is that message for? i tried to search but i did not yet find any thing about it
