cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
400
Views
0
Helpful
2
Replies

Port Based ACL Counters

BigDawgFelton
Beginner
Beginner

Hello again,

This is a continuation of my last post in which I need to apply ACLs to the physical ports within Etherchannels. The switch is a Catalyst 2970 running IOS 12.2. These Etherchannels are configured as trunks with 2 VLANS allowed on each trunk.

I have applied an inbound ACL on the physical ports that filters based on layer 3 and layer 4 traffic. The issue that I am seeing is that the counters for the ACL are not increasing even though the ACL is clearly doing its job. At the end of the ACL I have an entry of "permit ip any any". Removing this from the list causes connectivity problems to the server on this port. Adding it back and everything is back to normal. However the counters don't increase. At first I thought maybe this wasn't supported on this switch but then I noticed the counter had increased to "2 matches" later in the day.

Does anyone know what the normal behavior is for this switch and does it support logging on an ACL entry as well?

Thanks, Elton

Sent from Cisco Technical Support iPhone App

2 Replies 2

acampbell
VIP Alumni
VIP Alumni

Elton

ACL logging is not supported on the 2970 running 12.2

The switch does not support these Cisco IOS router ACL-related features:

Non-IP protocol ACLs (see Table 26-1) or bridge-group ACLs

IP accounting

Inbound and outbound rate limiting (except with QoS ACLs)

Reflexive ACLs or dynamic ACLs (except for some specialized dynamic ACLs used by the switch clustering feature)

ACL logging

http://www.cisco.com/en/US/docs/switches/lan/catalyst2970/software/release/12.2_18_se/configuration/guide/swacl.html

Regards,
Alex.
Please rate useful posts.

Regards, Alex. Please rate useful posts.

BigDawgFelton
Beginner
Beginner

Thanks for the quick response. As far as the logging is that just entries that are in the log file or does that also include match counts on an entry?

Why would I only have 2 matches if it is clearly doing its job?

Sent from Cisco Technical Support iPhone App

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: