1

What should happen when I configure the below ACL on an interface in a cisco 7600 box?

access-list TEST
 10 deny ip any any
 20 permit ip any any

Basically, when I ping the directly connected IP to this interface, all I observe is the hardware counters are incremented for permit rule, while the packets are getting dropped at software?

I know such an access-list has no meaning, but then too how the packets are processed in this scenario?

Scenario :

[R1](g4/1)-------------------------(g4/1)[R2]

Access-list TEST configured on R2 int g4/1for ingressing traffic.

Ping from R2 to R1 interface 4/1, and you get the below observations :

R2#show tcam interface g4/1 acl in ip mod 4

* Global Defaults shared

Entries from Bank 0

Entries from Bank 1

deny ip any any    
permit ip any any(5 matches)

R2# show ip access-list TEST

Extended IP access list TEST
10 deny ip any any (5 matches)
20 permit ip any any
Improve this question
3
  • and ofcourse the ping doesn't succeeds.
    – vikas gupta
    Feb 17, 2016 at 16:40
  • Where are you initiating your pings? Because Cisco routers behave differently when they are initiating pings vs. when they are forwarding pings.
    – Eddie
    Mar 18, 2016 at 20:50
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin ♦
    Aug 13, 2017 at 6:17

1 Answer 1

Reset to default
1

If you deny in the first line 10 deny ip any any than all packages will meet this rule and will denied by th router so the second rule 20 permit ip any any will never meet with packages. in one word no packages will pass trough on this interface. I don't understand why do want to deny all ip (tcp/udp) packages.

BTW: all ACL's have an implicit deny any any at end of all rules...

Improve this answer
1
  • Thanks Istvan !! This was just a test and I do understand that all the packets will be denied at first. But if you have a deeper look into the question, you can see that the hardware counters "permit ip any any" increases though the packets will be denied at a later stage when the packets are processed in software (icmp requires special processing where the packets have to be punted to msfc on a cisco box.) I am pretty much clear on the hardware ie. fast switching path but still my understanding lacks in the software processing for this weird ACL configuration. Any help is much appreciated.
    – vikas gupta
    Feb 18, 2016 at 6:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.