TCP Session filtered

[richi3161]

Hello,

I have a special case with exactly one TCP session, which is not transported:

SRC-IP A with Source Port 48408

The capture on the SPAN port shows, that the packet is delivered from the switchport to the router, but the router never receives the packet.

We have an ACL on the router, but no match.

Now, we add another statement, to have a match on the ACL, to check, if it works correctly.

What the interface counter of the switch shows:

GigabitEthernet3/21 is up, line protocol is up (connected)
  Hardware is Gigabit Ethernet Port, address is e02f.6d8a.5b40 (bia e02f.6d8a.5b40)
  Description: ***
  MTU 1500 bytes, BW 1000000 Kbit, DLY 10 usec,
     reliability 255/255, txload 1/255, rxload 1/255
  Encapsulation ARPA, loopback not set
  Keepalive set (10 sec)
  Full-duplex, 1000Mb/s, link type is force-up, media type is 1000BaseSX
  input flow-control is on, output flow-control is on
  ARP type: ARPA, ARP Timeout 04:00:00
  Last input never, output never, output hang never
  Last clearing of "show interface" counters 1d06h
  Input queue: 0/2000/0/0 (size/max/drops/flushes); Total output drops: 79
  Queueing strategy: fifo
  Output queue: 0/40 (size/max)
  5 minute input rate 58000 bits/sec, 99 packets/sec
  5 minute output rate 88000 bits/sec, 122 packets/sec
     3634280 packets input, 280804853 bytes, 0 no buffer
     Received 40369 broadcasts (40365 multicasts)
     0 runts, 0 giants, 0 throttles
     0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
     0 input packets with dribble condition detected
     4481995 packets output, 394120842 bytes, 0 underruns
     0 output errors, 0 collisions, 0 interface resets
     0 babbles, 0 late collision, 0 deferred
     0 lost carrier, 0 no carrier
     0 output buffer failures, 0 output buffers swapped out

...

[Madhukrishnan Gopinathan Nair]

Hello,

How are you determining it is not received on the router? 

Did you do a span capture on router port? Also if possible share the exact source ip address and the acl configuration so that we can check.

Thanks,

Madhu

[richi3161]

-----------------------------------------------------------------------------------------------------------------------------

Yes, I span the switchport, on which the router is connected.

There You can see:

[Madhukrishnan Gopinathan Nair]

Can you confirm the first line in your access-list the source ip is .129 and destination ip is .17?

If thats correct, span on router port to see if it is coming in? 

Thanks,

Madhu

[richi3161]

Yes, thats the ACL:

...
ip access-list extended LANINTERFACE-IN
 permit tcp host A1.A2.A3.129 eq 48408 host B1.B2.B3.17 eq 48093
 permit tcp host B1.B2.B3.17 eq 48093 host A1.A2.A3.129 eq 48408
 permit ip any any
 ...

And the trace is from the router-switchport.

rr

[jhager001]

did you try 'show access-list' to see if you're getting any deny hits?

[richi3161]

-----------------------------------------------------------------------------------------------------------------------------

...router#sh access-lists

...

Extended IP access list LANINTERFACE-IN
    10 permit tcp host A eq 48408 host B eq 48093
    20 permit tcp host B eq 48093 host A eq 48408
    30 permit ip any any (10028812 matches)

...

[jhager001]

your line 10 and 20 aren't receiving any hits, therefor that part of your ACL isn't working the way that you want it to. If you change the permit ip any any to an implicit deny, you should know whether or not your ACL is actually performing what you want. 

[richi3161]

...

Now the ACL looks better:

Extended IP access list LANINTERFACE-IN
    9 permit tcp host A1.A2.A3.129 eq 48407 host B1.B2.B3.17 eq 48093 (55 matches)
    10 permit tcp host A1.A2.A3.129 eq 48408 host B1.B2.B3.17 eq 48093
    11 permit tcp host A1.A2.A3.129 eq 14606 host B1.B2.B3.9 eq 48093
    30 permit ip any any (15859365 matches)

=> We see exactly, that the packet with the  SRC-PRT 48408 never arrives at the router.

[Madhukrishnan Gopinathan Nair]

Can you do a span on router port(not on switch port) and check

[richi3161]

How do You do a span on a router port?

[Madhukrishnan Gopinathan Nair]

What is your router model, we can possibly think of a packet capture on it. Sorry I have to take back the previous command as SPAN is not supported on router.

[richi3161]

For me it looks like a communication problem between the switch and the router. The drops on the switchport are the last point to check.

SWITCH-CONFIGURATION:
...
!
interface GigabitEthernet3/21
 description Router_G0/1_LAN
 switchport access vlan 88
 switchport mode access
 speed nonegotiate
 no snmp trap link-status
 spanning-tree portfast
...