Heads Up :
The post you are writing will appear in a public forum. Please ensure all content is appropriate for public consumption. Review the employee guidelines for the community here.
I have TAC case opened about this CSS problem. The TAC engineer said everything looks okay but doesn't know why it wouldn't work. I just found out he is going to be away until November. Before I requeue the case, I thought I would try to see anyone h...
Thanks! That did the trick! So the relevant acl entry now looks like ... clause 5 permit tcp nql YOU-R-BLOCKED_NQL destination content SITE/WWW prefer BLOCKED-1
Just tested with "deny" instead of "permit" and it blocked the traffic sourced from IP addresses listed in the nql. But the "prefer" option doesn't work.
The NQL is only small for testing. It will be much bigger for production use.Anyways, I did test with just the IP address directly in the ACL as you suggested, with the same result. No hit at all on the ACL clause.
You didn't really need to move to a different switch. A software upgrade to the switch would have fixed the problem. I upgraded my 2970 and 3750 switches to 12.2(20)SE1 and the problem stopped.