Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About servereasy
10-12-2018
Stats
Member since
07-28-2016
13
Posts
0
Helpful
0
Solutions
10-10-2018
04:16 AM
I have tried about 6 different IOS version and different chassis. This bug is always present. I can't understand how is it possible that nobody reported this problem, object-group is a very basic feauture...
... View more
09-30-2018
02:28 PM
The same problem is happening on a L3 interface:
interface GigabitEthernet6/1 ip address 2.2.2.2 255.255.255.0 ip access-group tmp in
end
... View more
09-30-2018
12:22 PM
Hi,
There is no particular reason, it's just for testing the ACL. I also tried with port not belonging to any VLAN with the same result:
Network object group testobj Description test host 1.2.3.4
Extended IP access list tmp 10 deny ip object-group testobj any
20 permit ip any any
After applying the ACL inbound to the port:
Actual result:
R1#sh tcam interface GigabitEthernet6/1 acl in ip
* Global Defaults shared Entries from Bank 0
deny ip any any
Expected result:
R1#sh tcam interface GigabitEthernet6/1 acl in ip
* Global Defaults shared Entries from Bank 0
deny ip host 1.2.3.4 any
permit ip any any
Thank you
Saverio
... View more
09-30-2018
05:45 AM
Hi Paul, I forgot to mention, there is a perm ip any any at the end. So that is not the problem. It seems that the object group is not expanding right
... View more
09-29-2018
06:20 PM
Just tried with 15.4(3)S9: same problem.
Is there someone succesfully using object-groups in 7600 with IOS 15.4/15.5?
... View more
09-29-2018
05:17 AM
Well, it really seems that is a bug:
R1#sh tcam interface GIgabitEthernet6/2 acl in ip
* Global Defaults shared
Entries from Bank 0
deny icmp any (---> this is the problem) any (8610 matches) permit ip any any
Entries from Bank 1
permit ip any any (369620 matches)
... View more
09-29-2018
04:59 AM
Thank you for your reply.
Configuration is very simple:
ip access-list extended tmp deny icmp object-group tmp any
object-group network tmp
host 1.2.3.4
interface GigabitEthernet6/2 switchport switchport access vlan 2 switchport mode access ip access-group tmp in
It seems that instead of matching only the content of the object-group, it matches everything. Really sounds like a bug.
... View more
09-29-2018
02:43 AM
Hello,
we are running IOS 15.5(3)S6 on a 7600 with RSP 720. We are seeing a strange behavior with ACL and object-groups:
Network object group tmp host 1.2.3.4
deny icmp object-group tmp any
expected result: ping from any host except 1.2.3.4 should work.
actual result: ping does not work.
It seems that "object-group tmp" equals to "any", because it matches everything.
Of course if I try:
deny icmp h 1.2.3.4 any
ping works except from 1.2.3.4, as expected.
... View more
Labels:
09-04-2018
03:27 AM
At the moment we absolutely need full routing table. I can't explain why filtering out prefixes doesn't change memory usage.
... View more
09-04-2018
02:45 AM
Dear all,
We are running IOS 15.1(2)SY7 on a 6500 with SUP730-3BXL. We are getting full routing table from two BGP peers, and we noticed a strange behavior in memory usage by "BGP router" process.
Since we have only 20MB of RAM available, we decided to filter out /24s on both peers by applying an inbound route-map.
"sh ip route summary" confirmed that the filter is working right (installed prefixes dropped from ~700k to ~300k), but memory usage of "BGP router" process didn't change:
Router#sh proc mem sort Processor Pool Total: 881258496 Used: 862203792 Free: 19054704 I/O Pool Total: 67108864 Used: 21605592 Free: 45503272
PID TTY Allocated Freed Holding Getbufs Retbufs Process 45 0 687443952 595980712 583092684 0 0 BGP Router
[.....]
bgp soft reconfiguration is not enabled. Any ideas? Thank you!
... View more
Labels:
08-17-2016
03:23 AM
Hi,
I would like to create ACLs that match packet payload. This should be possible with Cisco FPM (Flexible Patcket Matching). I can found lot of documentation about FPM syntax in IOS, but I can't find a list of devices that support that feauture.
... View more
Labels:
07-28-2016
04:02 AM
Dear all,
In Cisco 6500 w/ Sup 720 there is the possibility to rate-limit flows, this is also known as UBRL. Are there other Cisco devices having that feauture?
Thank you
... View more
Labels:
10-10-2018
I have tried about 6 different IOS version and different chassis. This
bug is always present. I can'...
09-30-2018
The same problem is happening on a L3 interface: interface
GigabitEthernet6/1 ip address 2.2.2.2 255...
09-30-2018
Hi, There is no particular reason, it's just for testing the ACL. I also
tried with port not belongi...
09-30-2018
Hi Paul,I forgot to mention, there is a perm ip any any at the end. So
that is not the problem. It s...
09-29-2018
Just tried with 15.4(3)S9: same problem. Is there someone succesfully
using object-groups in 7600 wi...
09-29-2018
Well, it really seems that is a bug: R1#sh tcam interface
GIgabitEthernet6/2 acl in ip * Global Defa...
09-29-2018
Thank you for your reply. Configuration is very simple: ip access-list
extended tmp deny icmp object...
09-29-2018
Hello, we are running IOS 15.5(3)S6 on a 7600 with RSP 720. We are
seeing a strange behavior with AC...
09-04-2018
At the moment we absolutely need full routing table. I can't explain why
filtering out prefixes does...
09-04-2018
Dear all, We are running IOS 15.1(2)SY7 on a 6500 with SUP730-3BXL. We
are getting full routing tabl...
08-17-2016
Hi, I would like to create ACLs that match packet payload. This should
be possible with Cisco FPM (F...
Public Statistics
| Date Registered | 07-28-2016 03:56 AM |
| Date Last Visited | 10-12-2018 09:49 AM |
| Total Messages Posted | 13 |
