I think that with an understanding of the configuration commands and rules you should be fine with access control lists. If your ACL isn’t working, first check that there is basic IP connectivity by pinging. Then check whether you have applied your ACL, that there are no typos, and whether you need to allow any IP traffic to pass (remember the implicit “deny all”). Some of the most important verification steps in the ACL troubleshooting process include:
- Verifying the ACL statistics
- Verifying the permitted networks
- Verifying the ACL interface and direction
Verifying the ACL Statistics
After you have successfully configured an ACL and applied it to an interface, it is very important to have a method by which you can verify the correct behaviour of the ACL, especially how many times an ACL entry has been used (hit). Based on the number of hits, you can adjust your filtering policy or you can enhance your ACLs to improve the overall security. Based on your needs, you can verify the ACL statistics on a global level or per interface (starting with IOS 12.4).
Global ACL Statistics
Global ACL statistics can be verifyied using the show ip access-list or show access-list commands, which can refer to a numbered or a named ACL:
Router#show ip access-lists
Extended IP access list test
10 deny tcp any any eq 80 (10 matches)
20 permit ip any any (56 matches)
This method may not provide very specific information in situations in which you apply the same ACL on different interfaces, as it offers overall statistics.
Per Interface ACL Statistics
In situations where you want to examine per interface ACL hits, either inbound or outbound, you can use the show ip access-list interface <interface_number> [in|out] command, as illustrated below:
Router#show ip access-list interface FastEthernet0/1 in
Extended IP access list 100 in
10 permit ip host 10.10.10.1 any (5 matches)
30 permit ip host 10.10.10.2 any (31 matches)
If no direction is specified, any input or output ACL applied to the specific interface is displayed. This feature is also called “ACL Manageability” and is available starting with IOS 12.4.
Verifying the Permitted Networks
Sometimes, especially in large environments where you have to configure many ACLs, you can make typo errors when configuring the ACL entries and this can lead to wrong traffic flows being blocked on different interfaces. In order to verify the correct ACL entries (permit and deny statements) you can use either the show run | section access-list or the show ip access-list commands, as described in previous sections.
Verifing the ACL Interface and Direction
One common error when applying an ACL to an interface is applying it in the wrong direction, meaning inbound instead of outbound and outbound instead of inbound. This can cause a lot of issues, both from a functionality and security perspective. One of the first steps you should take in an ACL troubleshooting process is verifying that the ACL is applied to the correct interface and in the correct direction.
Multiple commands exist to verify this, including the show run and the show ip access-list interface <interface> [in|out] commands.