The switch does not allow any routed access from a specific host, group of hosts, or
subnet
The implicit
deny any
function that the switch automatically applies as the last entry in any ACL may be blocking
all access by devices not specifically permitted by an entry in an ACL affecting those sources. If you are using the
ACL to block specific hosts, a group of hosts, or a subnet, but want to allow any access not specifically permitted,
insert
permit any
as the last explicit entry in the ACL.
The switch is not performing routing functions on a VLAN
Two possible causes of this problem are:
• Routing is not enabled. If
show running
indicates that routing is not enabled, use the
ip routing
command to enable routing.
• An ACL may be blocking access to the VLAN (on a switch covered in this guide). Ensure that the switch's IP
address on the VLAN is not blocked by one of the ACE entries in an ACL applied to that VLAN. A common
mistake is to either not explicitly permit the switch's IP address as a DA or to use a wildcard ACL mask in a
deny
statement that happens to include the switch's IP address. For an Example: of this problem, see section
"General ACL Operating Notes" in the "Access Control Lists (ACLs)" of the latest access security guide for
your switch.
Routing through a gateway on the switch fails
Configuring a "deny" ACE that includes a gateway address can block traffic attempting to use the gateway as a
next-hop.
Remote gateway case
Configuring ACL "101" (example below) and applying it outbound on VLAN 1 in the figure below includes the
router gateway (10.0.8.1) needed by devices on other networks. This can prevent the switch from sending ARP
and other routing messages to the gateway router to support traffic from authorized remote networks.
In
Figure 80: Inadvertently blocking a gateway
on page 463, this ACE (see data in bold below) denies access
to the 10 Net's 10.0.8.1 router gateway needed by the 20 Net (Subnet mask is 255.255.255.0).
Figure 80: Inadvertently blocking a gateway
To avoid inadvertently blocking the remote gateway for authorized traffic from another network (such as the 20
Net in this Example:):
Chapter 13 Troubleshooting
463
