Cisco MDS SanOS Troubleshooting Guide -- Troubleshooting IP Access Lists - Revision history

Pravraj: /* Cannot Remotely Connect to Switch */

2010-11-04T09:57:48Z

Cannot Remotely Connect to Switch

← Older revision		Revision as of 09:57, 4 November 2010
Line 515:		Line 515:

	{\| id="wp46140table46138" width="80%" border="1" cellpadding="3"		{\| id="wp46140table46138" width="80%" border="1" cellpadding="3"
-	\|+ '''Table 21-6 Cannot Remotely Connect to Switch'''\|	+
		+	\|+ '''Table 21-6 Cannot Remotely Connect to Switch'''
		+	\|- align="left" valign="bottom"
	! scope="col" \|		! scope="col" \|
	<div class="pCH1_CellHead1"> Symptom </div>		<div class="pCH1_CellHead1"> Symptom </div>

Pravraj: /* Cannot Remotely Connect to Switch */

2010-11-04T09:54:41Z

Cannot Remotely Connect to Switch

← Older revision		Revision as of 09:54, 4 November 2010
Line 515:		Line 515:

	{\| id="wp46140table46138" width="80%" border="1" cellpadding="3"		{\| id="wp46140table46138" width="80%" border="1" cellpadding="3"
-	\|+ '''Table 21-6 Cannot Remotely Connect to Switch'''\|~~- align="left" valign="bottom"~~	+	\|+ '''Table 21-6 Cannot Remotely Connect to Switch'''\|
	! scope="col" \|		! scope="col" \|
	<div class="pCH1_CellHead1"> Symptom </div>		<div class="pCH1_CellHead1"> Symptom </div>

Pravraj: /* Recreating IP-ACLs Using Fabric Manager */

2010-11-04T09:54:05Z

Recreating IP-ACLs Using Fabric Manager

← Older revision		Revision as of 09:54, 4 November 2010
Line 354:		Line 354:
	3. Click <span style="font-style: normal">'''<font color="Black">Apply Changes</font>'''</span> to save these changes.		3. Click <span style="font-style: normal">'''<font color="Black">Apply Changes</font>'''</span> to save these changes.

-	4 .Click the <span style="font-style: normal">'''<font color="Black">IP ACL wizard </font>'''</span>icon. You see the IP-ACL wizard dialog box.	+	4 Click the <span style="font-style: normal">'''<font color="Black">IP ACL wizard </font>'''</span>icon. You see the IP-ACL wizard dialog box.

	5. Add the IP-ACL name in the name field and click <span style="font-style: normal">'''<font color="Black">Add</font>'''</span>.		5. Add the IP-ACL name in the name field and click <span style="font-style: normal">'''<font color="Black">Add</font>'''</span>.

Pravraj: /* Cannot Remotely Connect to Switch */

2010-09-13T10:18:42Z

Cannot Remotely Connect to Switch

← Older revision		Revision as of 10:18, 13 September 2010
Line 515:		Line 515:

	{\| id="wp46140table46138" width="80%" border="1" cellpadding="3"		{\| id="wp46140table46138" width="80%" border="1" cellpadding="3"
-	\|+ Table 21-6 Cannot Remotely Connect to Switch	+	\|+ '''Table 21-6 Cannot Remotely Connect to Switch'''\|- align="left" valign="bottom"
-	\|- align="left" valign="bottom"	+
	! scope="col" \|		! scope="col" \|
	<div class="pCH1_CellHead1"> Symptom </div>		<div class="pCH1_CellHead1"> Symptom </div>

Pravraj: /* PortChannel Not Working with ACL */

2010-09-13T10:18:18Z

PortChannel Not Working with ACL

← Older revision		Revision as of 10:18, 13 September 2010
Line 485:		Line 485:

	{\| id="wp45991table45989" width="80%" border="1" cellpadding="3"		{\| id="wp45991table45989" width="80%" border="1" cellpadding="3"
-	\|+ Table 21-5 PortChannel Not Working with ACL	+	\|+ '''Table 21-5 PortChannel Not Working with ACL'''
	\|- align="left" valign="bottom"		\|- align="left" valign="bottom"
	! scope="col" \|		! scope="col" \|
Line 499:		Line 499:
	ACL not applied to all interfaces in the PortChannel.		ACL not applied to all interfaces in the PortChannel.
	\|		\|
-	Add the ACL to all interfaces in the PortChannel. Choose <span style="font-style: normal">'''<font color="Black">Switches > ISLs > Port Channels</font>'''</span> to view the Members Admin field to find out which interfaces are part of the PortChannel. Choose <span style="font-style: normal">'''<font color="Black">Switches > Security > IP ACL </font>'''</span>on Fabric Manager, ~~select~~ the <span style="font-style: normal">'''<font color="Black">Interfaces</font>'''</span> tab, and add the ACL name to the ProfileName field. Click <span style="font-style: normal">'''<font color="Black">Apply Changes</font>'''</span>.	+	Add the ACL to all interfaces in the PortChannel. Choose <span style="font-style: normal">'''<font color="Black">Switches > ISLs > Port Channels</font>'''</span> to view the Members Admin field to find out which interfaces are part of the PortChannel. Choose <span style="font-style: normal">'''<font color="Black">Switches > Security > IP ACL </font>'''</span>on Fabric Manager, click the <span style="font-style: normal">'''<font color="Black">Interfaces</font>'''</span> tab, and add the ACL name to the ProfileName field. Click <span style="font-style: normal">'''<font color="Black">Apply Changes</font>'''</span>.

-	~~Or use~~ the<span style="font-style: normal">'''<font color="Black"> show port-channel database</font>'''</span> CLI command to find out which interfaces are part of the PortChannel and then use the <span style="font-style: normal">'''<font color="Black">ip access-group</font>'''</span> or the <span style="font-style: normal">'''<font color="Black">ipv6 traffic-filter </font>'''</span>CLI command in interface mode to add the ACL to all interfaces in the PortChannel.	+	Use the<span style="font-style: normal">'''<font color="Black"> show port-channel database</font>'''</span> CLI command to find out which interfaces are part of the PortChannel and then use the <span style="font-style: normal">'''<font color="Black">ip access-group</font>'''</span> or the <span style="font-style: normal">'''<font color="Black">ipv6 traffic-filter </font>'''</span>CLI command in interface mode to add the ACL to all interfaces in the PortChannel.
	\|}		\|}

Pravraj: /* No Packets Are Blocked */

2010-09-13T10:17:27Z

No Packets Are Blocked

← Older revision		Revision as of 10:17, 13 September 2010
Line 452:		Line 452:

	{\| id="wp45858table45856" width="80%" border="1" cellpadding="3"		{\| id="wp45858table45856" width="80%" border="1" cellpadding="3"
-	\|+ Table 21-4 No Packets Are blocked	+	\|+ '''Table 21-4 No Packets Are blocked'''
	\|- align="left" valign="bottom"		\|- align="left" valign="bottom"
	! scope="col" \|		! scope="col" \|
Line 466:		Line 466:
	A permit filter is too broad.		A permit filter is too broad.
	\|		\|
-	Delete the permit filter. Add an appropriate permit filter. Choose<span style="font-style: normal">'''<font color="Black"> Security > IP ACL </font>'''</span>in Device Manager, right- click the access list and click <span style="font-style: normal">'''<font color="Black">Rules</font>'''</span>. Right-click the rule and click <span style="font-style: normal">'''<font color="Black">Delete.</font>'''</span>	+	Delete the permit filter. Add an appropriate permit filter. Choose<span style="font-style: normal">'''<font color="Black"> Security > IP ACL </font>'''</span>in Device Manager, right- click the access list and click <span style="font-style: normal">'''<font color="Black">Rules</font>'''</span>. Right click the rule and click <span style="font-style: normal">'''<font color="Black">Delete.</font>'''</span>

-	Or use the <span style="font-style: normal">'''<font color="Black">no ip access-list</font>'''</span> for IPv4-ACLs or <span style="font-style: normal">'''<font color="Black">no ipv6 access-list </font>'''</span>for IPv6, and use the <span style="font-style: normal">'''<font color="Black">no permit </font>'''</span>CLI command in IP-ACL configuration submode.	+	You can also use the <span style="font-style: normal">'''<font color="Black">no ip access-list</font>'''</span> for IPv4-ACLs or <span style="font-style: normal">'''<font color="Black">no ipv6 access-list </font>'''</span>for IPv6, and use the <span style="font-style: normal">'''<font color="Black">no permit </font>'''</span>CLI command in IP-ACL configuration submode.
	\|- align="left" valign="top"		\|- align="left" valign="top"
	\|		\|
	Permit filter is too high in the access list order.		Permit filter is too high in the access list order.
	\|		\|
-	Delete the access list and ~~re-create~~. See the ~~'''~~"~~Re-creating~~ IP-ACLs Using Fabric Manager"~~'''~~ section or the ~~'''~~"Re-creating IP-ACLs Using the CLI"~~'''~~ section.	+	Delete the access list and recreate. See the "Recreating IP-ACLs Using Fabric Manager" section or the "Re-creating IP-ACLs Using the CLI" section.
	\|}		\|}

Pravraj: /* Re-creating IP-ACLs Using the CLI */

2010-09-13T10:15:37Z

Re-creating IP-ACLs Using the CLI

← Older revision		Revision as of 10:15, 13 September 2010
Line 366:		Line 366:
	----		----

-	=== ~~Re-creating~~ IP-ACLs Using the CLI ===	+	=== Recreating IP-ACLs Using the CLI ===

-	To ~~r-create~~ an IP-ACL using the CLI, follow these steps:	+	To recreate an IP-ACL using the CLI, follow these steps:

	----		----
Line 397:		Line 397:
	</pre>		</pre>

-	2. Use the <span style="font-style: normal">'''<font color="Black">no ip access-group</font>'''</span> or the <span style="font-style: normal">'''<font color="Black">no ipv6 traffic-filter</font>'''</span> command in interface mode to remove the ACL from the interface. Repeat this step for all interfaces found in ~~'''~~Step 1~~'''~~.	+	2. Use the <span style="font-style: normal">'''<font color="Black">no ip access-group</font>'''</span> or the <span style="font-style: normal">'''<font color="Black">no ipv6 traffic-filter</font>'''</span> command in interface mode to remove the ACL from the interface. Repeat this step for all interfaces found in Step 1.

	<pre>		<pre>
Line 415:		Line 415:

	----		----
-	{{Note \|We recommend deleting an ACL and ~~re-creating~~ it because you cannot change the order of filters in an ACL.}}	+	{{Note \|We recommend deleting an ACL and recreating it because you cannot change the order of filters in an ACL.}}
	----		----

Line 430:		Line 430:
	----		----

-	5. Use the <span style="font-style: normal">'''<font color="Black">ip access-group</font>'''</span> or the <span style="font-style: normal">'''<font color="Black">ipv6 traffic-filter</font>'''</span> command in interface mode to add the ACL to the interface. Repeat this step for all interfaces found in ~~[#wp45412 <span class="cXRef_Color" style="font-weight: normal">~~Step 1~~</span>]~~.	+	5. Use the <span style="font-style: normal">'''<font color="Black">ip access-group</font>'''</span> or the <span style="font-style: normal">'''<font color="Black">ipv6 traffic-filter</font>'''</span> command in interface mode to add the ACL to the interface. Repeat this step for all interfaces found in Step 1.

	<pre>		<pre>

Pravraj: /* Re-creating IP-ACLs Using Fabric Manager */

2010-09-13T10:13:58Z

Re-creating IP-ACLs Using Fabric Manager

← Older revision		Revision as of 10:13, 13 September 2010
Line 342:		Line 342:
	<br />		<br />

-	=== ~~Re-creating~~ IP-ACLs Using Fabric Manager ===	+	=== Recreating IP-ACLs Using Fabric Manager ===

	To re-create an IP-ACL using Fabric Manager, follow these steps:		To re-create an IP-ACL using Fabric Manager, follow these steps:
Line 350:		Line 350:
	1. Choose <span style="font-style: normal">'''<font color="Black">Switches > Security > IP ACL </font>'''</span>and select the <span style="font-style: normal">'''<font color="Black">Interfaces</font>'''</span> tab.		1. Choose <span style="font-style: normal">'''<font color="Black">Switches > Security > IP ACL </font>'''</span>and select the <span style="font-style: normal">'''<font color="Black">Interfaces</font>'''</span> tab.

-	2. Right-click all interfaces that have the IP-ACL you need to modify and remove the IP-ACL name from the ProfileName field.	+	2. Right-click all interfaces that have the IP-ACL that you need to modify and remove the IP-ACL name from the ProfileName field.

	3. Click <span style="font-style: normal">'''<font color="Black">Apply Changes</font>'''</span> to save these changes.		3. Click <span style="font-style: normal">'''<font color="Black">Apply Changes</font>'''</span> to save these changes.

Pravraj: /* All Packets Are Blocked */

2010-09-13T09:50:04Z

All Packets Are Blocked

← Older revision		Revision as of 09:50, 13 September 2010
Line 300:		Line 300:

	{\| id="wp45768table45766" width="80%" border="1" cellpadding="3"		{\| id="wp45768table45766" width="80%" border="1" cellpadding="3"
-	\|+ Table 21-3 All Packets Are Blocked	+	\|+ '''Table 21-3 All Packets Are Blocked'''
	\|- align="left" valign="bottom"		\|- align="left" valign="bottom"
	! scope="col" \|		! scope="col" \|
Line 314:		Line 314:
	Access list is empty.		Access list is empty.
	\|		\|
-	Remove the access list from the interface. Choose <span style="font-style: normal">'''<font color="Black">Switches > Security > IP ACL</font>'''</span> in Fabric Manager, ~~select~~ the <span style="font-style: normal">'''<font color="Black">Interfaces</font>'''</span> tab, and remove the ACL name from the ProfileName field. Click <span style="font-style: normal">'''<font color="Black">Apply Changes</font>'''</span>.	+	Remove the access list from the interface. Choose <span style="font-style: normal">'''<font color="Black">Switches > Security > IP ACL</font>'''</span> in Fabric Manager, click the <span style="font-style: normal">'''<font color="Black">Interfaces</font>'''</span> tab, and remove the ACL name from the ProfileName field. Click <span style="font-style: normal">'''<font color="Black">Apply Changes</font>'''</span>.

-	~~Or use~~ the <span style="font-style: normal">'''<font color="Black">no ip access-group</font>'''</span> or the <span style="font-style: normal">'''<font color="Black">no ipv6 traffic-filter </font>'''</span>CLI command in interface mode.	+	Use the <span style="font-style: normal">'''<font color="Black">no ip access-group</font>'''</span> or the <span style="font-style: normal">'''<font color="Black">no ipv6 traffic-filter </font>'''</span>CLI command in interface mode.
	\|- align="left" valign="top"		\|- align="left" valign="top"
	\|		\|
Line 323:		Line 323:
	Delete the deny filter. Choose<span style="font-style: normal">'''<font color="Black"> Security > IP ACL </font>'''</span>in Device Manager, right-click the access list, and click <span style="font-style: normal">'''<font color="Black">Rules</font>'''</span>. Right-click the filter you want to delete and click <span style="font-style: normal">'''<font color="Black">Delete</font>'''</span>.		Delete the deny filter. Choose<span style="font-style: normal">'''<font color="Black"> Security > IP ACL </font>'''</span>in Device Manager, right-click the access list, and click <span style="font-style: normal">'''<font color="Black">Rules</font>'''</span>. Right-click the filter you want to delete and click <span style="font-style: normal">'''<font color="Black">Delete</font>'''</span>.

-	~~Or use~~ the <span style="font-style: normal">'''<font color="Black">no ip access-list</font>'''</span> for IPv4-ACLs or <span style="font-style: normal">'''<font color="Black">no ipv6 access-list </font>'''</span>for IPv6, and use the <span style="font-style: normal">'''<font color="Black">no deny</font>'''</span> CLI command in IP-ACL configuration submode.	+	Use the <span style="font-style: normal">'''<font color="Black">no ip access-list</font>'''</span> for IPv4-ACLs or <span style="font-style: normal">'''<font color="Black">no ipv6 access-list </font>'''</span>for IPv6, and use the <span style="font-style: normal">'''<font color="Black">no deny</font>'''</span> CLI command in IP-ACL configuration submode.
	\|- align="left" valign="top"		\|- align="left" valign="top"
	\|		\|
	Deny filter is too high in the access list order.		Deny filter is too high in the access list order.
	\|		\|
-	Delete the access list and ~~re-create~~. See the '''"Re-creating IP-ACLs Using Fabric Manager"''' section or the '''"Re-creating IP-ACLs Using the CLI"''' section.	+	Delete the access list and recreate. See the '''"Re-creating IP-ACLs Using Fabric Manager"''' section or the '''"Re-creating IP-ACLs Using the CLI"''' section.
	\|- align="left" valign="top"		\|- align="left" valign="top"
	\|		\|
Line 335:		Line 335:
	Add an appropriate permit filter. Choose<span style="font-style: normal">'''<font color="Black"> Security > IP ACL </font>'''</span>in Device Manager, right-click the access list, and click <span style="font-style: normal">'''<font color="Black">Rules</font>'''</span>. Click <span style="font-style: normal">'''<font color="Black">Create.</font>'''</span>		Add an appropriate permit filter. Choose<span style="font-style: normal">'''<font color="Black"> Security > IP ACL </font>'''</span>in Device Manager, right-click the access list, and click <span style="font-style: normal">'''<font color="Black">Rules</font>'''</span>. Click <span style="font-style: normal">'''<font color="Black">Create.</font>'''</span>

-	Or use the <span style="font-style: normal">'''<font color="Black">ip access-list</font>'''</span> for IPv4-ACLs or <span style="font-style: normal">'''<font color="Black">ipv6 access-list </font>'''</span>for IPv6, and use the<span style="font-style: normal">'''<font color="Black"> permit</font>'''</span> CLI command in IP-ACL configuration submode.	+	You also can use the <span style="font-style: normal">'''<font color="Black">ip access-list</font>'''</span> for IPv4-ACLs or <span style="font-style: normal">'''<font color="Black">ipv6 access-list </font>'''</span>for IPv6, and use the<span style="font-style: normal">'''<font color="Black"> permit</font>'''</span> CLI command in IP-ACL configuration submode.
	\|}		\|}

Pravraj: /* Common Troubleshooting Commands in the CLI */

2010-09-13T09:48:16Z

Common Troubleshooting Commands in the CLI

← Older revision		Revision as of 09:48, 13 September 2010
Line 276:		Line 276:
	The following commands may be useful in troubleshooting IP-ACL issues:		The following commands may be useful in troubleshooting IP-ACL issues:

-	* show ip access-list	+	* '''show ip access-list'''
-	* show ipv6 access-list	+	* '''show ipv6 access-list'''
-	* show interface	+	* '''show interface'''
	* Use the log-deny option at the end of a filter condition to log information about packets that match dropped entries. The log output displays the ACL number, permit or deny status, and port information. Use the following CLI commands to ensure that the debug messages are logged to the logfile for the kernel and ipacl facilities:		* Use the log-deny option at the end of a filter condition to log information about packets that match dropped entries. The log output displays the ACL number, permit or deny status, and port information. Use the following CLI commands to ensure that the debug messages are logged to the logfile for the kernel and ipacl facilities:
-	** logging logfile SyslogFile 7	+	* '''logging logfile SyslogFile 7'''
-	** logging level kernel 7	+	* '''logging level kernel 7'''
-	** logging level ipacl 7	+	* '''logging level ipacl 7'''

	== IP-ACL Issues ==		== IP-ACL Issues ==