Hi there,
I am having some issue with SVI ACLs on Cat 6500. I am not able to see ACL being hit on match. Probably I am missing something. Any suggestion would be appreciated.
The ACL is applied inbound on the SVI interface. I tested port 80 and 443 access. Users on the vlan 114 are able to access these ports but I don't see any hit count on the ACL So I am not sure if the ACL is working properly. The only matches I see is for bootp, HSRP, and deny ACL. I have checked both primary hsrp and secondary switch acl and both are not showing match on these ports. I can browse on http and https but there in no log entry. I have not tried other ports.
The second question I have is if I want to see the log of what is being denied how do I see all the details? ip accounting? I enabled it but no output in show command.
access-list 114 remark GUEST-ACL
access-list 114 permit udp any any eq bootps
access-list 114 permit udp any any eq domain
access-list 114 permit tcp any any eq 443
access-list 114 permit tcp any any eq www
access-list 114 permit icmp any any
access-list 114 permit ip host 172.20.35.3 host 224.0.0.2
access-list 114 deny ip any any log
interface Vlan114
ip address 172.20.35.2 255.255.255.0
ip access-group 114 in
no ip redirects
no ip unreachables
no ip proxy-arp
standby 1 ip 172.20.35.1
standby 1 priority 110
standby 1 preempt
sw#sh access-lists 114
Extended IP access list 114
10 permit udp any any eq bootps (234 matches)
20 permit udp any any eq domain
30 permit tcp any any eq 443
40 permit tcp any any eq www
50 permit icmp any any
60 permit ip host 172.20.35.3 host 224.0.0.2 (78 matches)
70 deny ip any any log (277 matches)
