Network Engineering Stack Exchange is a question and answer site for network engineers. It only takes a minute to sign up.
Sign up to join this community
I have created vlan access-map in my Cisco Catalyst 2960X to block https traffic:
ip access-list extended no443
permit tcp any any eq 443
vlan access-map block443 10
match ip address no443
action drop
vlan access-map block443 20
action forward
vlan filter block443 vlan-list 1
Rule works, it blocks https traffic.
But I cannot see rule hits (matches).
And show vlan access-map, show vlan filter commands are not supported by my switch.
How can I see rule matches (hits) ?
Jesse P. is correct.
The Cisco 2960/S/X Series processes all access lists in hardware and therefore does not show any hit counters, when you use sh access-lists or sh ip access-lists.
You can show the hardware counters by using sh access-lists hardware counters, but it will only give basic input/output statistics like dropped packets, forwarded etc.
You could try to log the hits on the access-list:
ip access-list extended no443
permit tcp any any eq 443 log
This will enable the CPU to start logging everything and therefore show hit counters. Please be advised though, that it could also overload your switch CPU and eventually crash the switch.
