2

I have created vlan access-map in my Cisco Catalyst 2960X to block https traffic:

ip access-list extended no443
permit tcp any any eq 443

vlan access-map block443 10
match ip address no443
action drop

vlan access-map block443 20
action forward

vlan filter block443 vlan-list 1

Rule works, it blocks https traffic.
But I cannot see rule hits (matches).

And show vlan access-map, show vlan filter commands are not supported by my switch.

How can I see rule matches (hits) ?

Improve this question
  • Some types of traffic and ACLs are processed in hardware, and others in software. If this is one of the types processed in hardware, you will not see hits. – Jesse P. Jun 12 '19 at 12:30
  • check show ip access-lists, not positive but it may show up there – user52444 Jun 12 '19 at 13:14
  • @CoreyBorders, show ip access-lists does not show hits too. – it dev Jun 13 '19 at 3:44
1

Jesse P. is correct.

The Cisco 2960/S/X Series processes all access lists in hardware and therefore does not show any hit counters, when you use sh access-lists or sh ip access-lists.

You can show the hardware counters by using sh access-lists hardware counters, but it will only give basic input/output statistics like dropped packets, forwarded etc.

You could try to log the hits on the access-list:

ip access-list extended no443
permit tcp any any eq 443 log

This will enable the CPU to start logging everything and therefore show hit counters. Please be advised though, that it could also overload your switch CPU and eventually crash the switch.

Improve this answer
  • show access-lists hardware counters works. Thanks! – it dev Jun 13 '19 at 12:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.