9

I have encountered something I'm not familiar with in a customer's configuration, I know that the "(hitcnt=324165)" at the end of every rule in "show access-list" points to rule usage, hit count. But in this output of show access-list I'm also seeing numbers following object and non-object entities in the rule.

Example

access-list access-global-in line 5 extended deny ip object-group HA_Networks_All any log 
 informational interval 300 0xf688d263

access-list access-global-in line 5 extended deny ip object-group HA_Networks_All(298) any(65537) log 
 informational interval 300 (hitcnt=324165) 0xa2669c62

access-list access-global-in line 7 extended deny ip object-group HA-Wireless_10.1.80.0-24 any log 
 informational interval 300 0xb25caeed 

access-list access-global-in line 7 extended deny ip object-group HA-Wireless_10.1.80.0-24(299) 
 any(65537) log informational interval 300 (hitcnt=2133314) 0x111a2d28

Notice that the same rule is displayed twice (same line number) but once with the parentheses inside the rule and once without.

Is this some sort of object usage? If so how can it be different from the hit count? I couldn't find any documentation explaining this.

Improve this question
1
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can post and accept your own answer.
    – Ron Maupin ♦
    Jan 3, 2021 at 5:57

1 Answer 1

Reset to default
6
+50

Great question! You're right in thinking that it is a function of your object-group.

You have ACL optimisation activated. This is activated via the global CLI command object-group-search access-control .

ACL optimisation collapses all the possible ACE combinations for source/destination addresses and ports back into your original objects. The numbers in parentheses are the amount of entries that have been collapsed into that single entry.

When ACL optimisation is disabled, the show access-list command will show you the expanded entries instead.

The object-group-search access-control command is service affecting and will drop connections while it is performing the algorithm.

Improve this answer
2
  • 1
    First of all, thank you mbud for your answer, but Mike is right. My question is about the parentheses that follow the objects within the rule, since these examples are of "deny/permit ip" ACLs and we see the number after network objects I don't think these are port numbers. Also please notice that the number that follows "Any" on the ACL Mike took for an example is 65537, either too high to be a port number or suspiciously close... :) Still in the dark about this.
    – Harnik
    Jul 30, 2014 at 7:11
  • 2
    Okay so I think I've figured it out. You must have object-group optimisation turned on. object-group-search access-control Object-group optimisation stops the behaviour I described above. It collapses all the possible combinations for source/destination addresses and ports back into your original objects. The numbers in parentheses are the amount of entries that have been optimised to that single ACE.
    – mbud
    Jul 30, 2014 at 14:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.