The show ip interface command can be used to tell if an inbound or an outbound access list has been applied to an interface. Rows 9 and 10 of the following output contain the information. The rest of the lines don’t pertain to ACLs, so they’ve been omitted. You should recall that the show ip interface command displays all interfaces, but adding the interface ID, such as show ip interface s0/0, to the end of the command limits the output to that interface. Rtr1#show ip interface Ethernet0 is up, line protocol is up ?Internet address is 192.168.5.1/24 ?Broadcast address is 255.255.255.255 ?Address determined by non-volatile memory ?MTU is 1500 bytes ?Helper address is not set ?Directed broadcast forwarding is disabled ?Multicast reserved groups joined: 224.0.0.9 Outgoing access list is 50 ???????????????<-Outbound ACL 50 applied Inbound ?access list is not set ??????????<-No inbound ACL is applied Proxy ARP is enabled.
...but your activity and behavior on this site made us think that you are a bot. Note: A number of things could be going on here.
I have access-lists in place. When i use the show ip access-list command, some of access-lists show counters (hit counts), and some don't. If I change the rule from permit to deny, interesting traffic is denied and counters will appear, but when I change to permit again the counters won't increase, although there is the traffic which is allowed with same sequence number. 1 Get full access to Cisco IOS Cookbook, 2nd Edition and 60K+ other titles, with free 10-day trial of O'Reilly. There's also live online events, interactive content, certification prep materials, and more.
You want to know when the router invokes an access-list. Access-lists can generate log messages. The following example allows all packets to pass, and records them: Router1#configure terminal Enter configuration commands, one per line. End with CNTL/Z. Router1(config)#access-list 150 permit ip any any log Router1(config)#interface Serial0/1 Router1(config-if)#ip access-group 150 in Router1(config-if)#exit Router1(config)#end Router1#And in this example, we use the log-input keyword to include additional information about where the packets came from: Router1#configure terminal Enter configuration commands, one per line. End with CNTL/Z. Router1(config)#access-list 150 permit tcp any any log-input Router1(config)#access-list 150 permit ip any any Router1(config)#interface Serial0/1 Router1(config-if)#ip access-group 150 in Router1(config-if)#exit Router1(config)#end Router1#The first example uses the log keyword to record a log message every time the ACL makes a match. Here are some log messages generated by this command: Feb 6 13:01:19: %SEC-6-IPACCESSLOGRP: list 150 permitted ospf 10.1.1.1 -> 224.0.0.5, 9 packets Feb 6 13:01:19: %SEC-6-IPACCESSLOGDP: list 150 permitted icmp 10.1.1.1 -> 10.1.1.2 (0/0), 4 packetsYou can also get a breakdown of how many matches each line in the ACL has recorded with the show access-list command: Router1#show access-list 150 Extended IP access list 150 permit ip any any log (15 matches) Router1# ...Get Cisco IOS Cookbook, 2nd Edition now with O’Reilly online learning. O’Reilly members experience live online training, plus books, videos, and digital content from 200+ publishers.
Get Mark Richards’s Software Architecture Patterns ebook to better understand how to design components—and how they should interact. It’s yours, free.Get it now
SW#sh ip access-listsExtended IP access list 102 5 permit tcp 192.168.0.0.0 0.0.255.255 196.189.80.0 0.0.0.15 eq 23 (no matches ) Please assist.
This module describes how to display the entries in an IP access list and the number of packets that have matched each entry. Users can get these statistics globally, or per interface and per incoming or outgoing traffic direction, by using the ACL Manageability feature. Viewing details of incoming and outgoing traffic patterns on various interfaces of a network device can help secure devices against attacks coming in on a particular interface. This module also describes how to clear counters so that the count of packets matching an access list entry will restart from zero.
Your software release may not support all the features documented in this module. For the latest caveats and feature information, see Bug Search Tool and the release notes for your platform and software release. To find information about the features documented in this module, and to see a list of the releases in which each feature is supported, see the feature information table at the end of this module. Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to www.cisco.com/go/cfn. An account on Cisco.com is not required.
Prior to Cisco IOS Release 12.4(6)T, the ACL infrastructure in Cisco IOS software maintained only global statistics for each ACE in an ACL. With this method, if an ACL is applied to multiple interfaces, the maintained ACE statistics are the sum of incoming and outgoing packet matches (hits) on all the interfaces on which that ACL is applied. However, if ACE statistics are maintained per interface and per incoming or outgoing traffic direction, users can view specific details of incoming and outgoing traffic patterns and the effectiveness of ACEs on the various interfaces of a network device. This type of information is useful for securing devices against attacks coming in on a particular interface.
With Cisco IOS Release 12.4(6)T, the ACL infrastructure in Cisco IOS software is now extended to support the maintenance, display, and clearing of ACE statistics per interface and per incoming or outgoing traffic direction for ACLs. This support is often referred to as "support for interface-level statistics."
This section contains the following procedures for displaying IP access lists and the counts of packets that match (hit) each list, and for clearing IP access list counters.
Perform this task to display all IP access lists on the router and counts of packets that have matched. SUMMARY STEPSDETAILED STEPS
This section describes how to display IP ACE statistics per interface and per incoming or outgoing traffic direction for ACLs. This feature is known as ACL Manageability.
DETAILED STEPS
The system counts how many packets match (hit) each line of an access list; the counters are displayed by the show access-lists EXEC command. Perform this task to clear the counters of an access list. You might do this if you are trying to determine a more recent count of packets that match an access list, starting from zero. SUMMARY STEPSDETAILED STEPS
The following example displays global statistics for ACL 150: Router# show ip access-list 150 Extended IP access list 150 10 permit ip host 10.1.1.1 any (3 matches) 30 permit ip host 10.2.2.2 any (27 matches)
The following example displays statistics on incoming packets gathered from the FastEthernet interface 0/1, associated with access list 150 (ACL number): Router# show ip access-list interface FastEthernet 0/1 in Extended IP access list 150 in 10 permit ip host 10.1.1.1 any (3 matches) 30 permit ip host 10.2.2.2 any (12 matches)
The following example displays statistics on outgoing packets gathered from the FastEthernet interface 0/0: Router# show ip access-list interface FastEthernet 0/0 out Extended IP access list myacl out 5 deny ip any 10.1.0.0 0.0.255.255 10 permit udp any any eq snmp (6 matches)
The following example displays input and output statistics gathered from the FastEthernet interface 0/0: Router# show ip access-list interface FastEthernet 0/0 Extended IP access list 150 in 10 permit ip host 10.1.1.1 any 30 permit ip host 10.2.2.2 any (15 matches) Extended IP access list myacl out 5 deny ip any 10.1.0.0 0.0.255.255 10 permit udp any any eq snmp (6 matches)
The following example clears global and interface statistics for IP ACL 150: Router# clear ip access-list counters 150
The following example clears global and interface statistics for all IP ACLs: Router# clear ip access-list counters
The following table provides release information about the feature or features described in this module. This table lists only the software release that introduced support for a given feature in a given software release train. Unless noted otherwise, subsequent releases of that software release train also support that feature. Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to www.cisco.com/go/cfn. An account on Cisco.com is not required.
Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks, go to this URL: www.cisco.com/go/trademarks. Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (1110R) Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display output, network topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in illustrative content is unintentional and coincidental. © 2012 Cisco Systems, Inc. All rights reserved. |
