Mypower
S4100
Troubleshooting
Maipu Confidential & Proprietary Information
Page
46
of
124
The ACL is not applied to the
corresponding object.
Use the show acl-object command to view whether the
object is configured with the ACL for packet filtering. Configure
at the IN direction. For example, the following indicates that
ACL is applied on port 0/0/4.
sw201#show acl-object
----------------Port--Bind--Instance--------------
PortId-------------------Direction----AclType----AclName
port 0/0/4 IN MAC 3001
----------------Vlan--Bind--Instance--------------
VlanId-------------------Direction----AclType----AclName
----------------Global--Bind--Instance--------------
Global-------------------Direction----AclType----AclName
The fault of time-range
Use the show access-list command to view whether the
associated time-range of the configured ACL is inactive. If yes,
it indicates that the present moment is the time when the
associated time-range of the ACL takes effect, so it is normal
that the ACL does not take effect at present. If the associated
time-range is active, it indicates that the ACL takes effect at
present. To view the time-range configuration, you can use the
show time-range command.
For example, the following associated time is 3-4 o’clock every
weekend. If not in the period, the ACL does not take effect
and the packet filtering cannot be performed.
sw201#show access-list
ip access-list standard 1
10 deny 10.0.0.0 0.0.0.255 time-range 33 (inactive)
Fault 2: After configuring the rule of denying the access of one segment
or host, the data of other segment is also denied.
Possible Reasons
Judging Methods and Solutions
It is the fault of the deny
any rule of the ACL.
All non-empty ACLs have one deny any ACE rule, which does
not need to be configured by the user and cannot be seen by
the show access command. Therefore, after configuring the
rule of denying one segment or host, all other data is denied
because of the last default rule.
You can configure one permit any at last to solve the problem.
Fault 3: After configuring the rule of permitting the access of one
segment or host address, the packets of the segment or host are still
denied.
Possible Reasons
Judging Methods and Solutions
The rules configured in ACL
conflict. For example, there
is other rule of denying the
data before the permit rule.
One ACL is configured with multiple ACEs. The data matches
ACEs according to the ACE order. Once matching one, the data
does not continue to match the next ACE. For example, the
following ACL is to permit source ip 10.0.0.1 and deny the
packet forwarding of other source IP 10.0.0.0/24 segment, but
according to the following ACL, 10.0.0.1 is blocked.
ip access-list standard 1
10 deny 10.0.0.0 0.0.0.255
