Cisco IOS Access Lists

Packet-filtering access control lists

Here I talk about debugging the packet filters that you implement with access control lists. Like the previous section, I first talk about how to verify that your access lists are correct, followed by a section about how to find the problems in the access lists that you find to be wrong.

Checking for correctness

One of the first things you want to do is make sure that your access lists are applied to the interfaces you intended. You or another network administrator may have removed access lists or applied other access lists in order to debug problems or temporarily enable certain functionality for a variety of reasons, such as host installations or debugging. One way to do that is to show the running configuration with the show running-confg command. If you have a large configuration, this command may take a while, and it is easy to miss the interface you want to look at when many of them are scrolling by.

Using show ip interface to display applied access lists

A better way is to use the show ip interface command. This command yields output that looks like the following:

Serial 0 is up, line protocol is up Internet address is 192.168.1.2/24 Broadcast address is 192.168.1.255 Address determined by non-volatile memory MTU is 1500 bytes Helper address is not set Directed broadcast forwarding is enabled Outbound access list is 102 Inbound access list is 101 Proxy ARP is enabled Security level is default Split horizon is enabled ICMP redirects are ...