Mypower
S4100
Troubleshooting
Maipu Confidential & Proprietary Information
Page
47
of
124
20 permit host 10.0.0.1
This is because rule 10 is matched first, so rule 20 is not
matched again. You can adjust the ACE order to solve the
problem, that is, configure permit host 10.0.0.1 before
configuring deny 10.0.0.0 or change the rule serial number of
permit10.0.0.1 to be smaller than the serial number of deny
rule.
ip access-list standard 1
5 permit host 10.0.0.1
10 deny 10.0.0.0 0.0.0.255
The system time is not in
the associated time range of
the ACL.
You can use the show access-list command to view whether
the ACL that is associated with time range takes effect now.
For example, the following indicates that the system time is not
within time range, so the ACL is invalid and cannot deny data.
ip access-list standard 1
5 permit host 10.0.0.1 time-range 33 (inactive)
10 deny 10.0.0.0 0.0.0.255
Fault 4: Enabling the ACL on the object fails.
Possible Reasons
Judging Methods and Solutions
The port belongs to one link
aggregation port and you
cannot enable ACL on the
port.
Use the show run command to view the port configuration, so
as to judge whether the port is added to one link aggregation
group. If yes, you can only configure ACL on the link group or
exit the link aggregation port and then enable the ACL.
The object is bound to the
same type of ACL.
Use the show acl-object command to view whether the
object is bound with the same type of ACL. For example, one
port can only be bound with one IP ACL and one MAC ACL. If
you bind again, the system prompts error. For example, port
port 0/0/6 is bound with mac access-group 3001. If you bind
mac access-group 3002 again, the system has the following
prompt information:
sw201(config-port-0/0/6)#mac access-group 3002 in
% An Acl has been bound. Please delete it if you want to bind
others to it.
The object does not support
binding the type of ACL.
In the vlan and global mode, you can only bind IP ACL, but
cannot bind MAC ACL, so if you bind MAC ACL in vlan or global
mode, the system has the following prompt information:
sw201(config)#vlan 10
sw201(config-vlan10)#mac access group 3001 in
^
% Invalid input detected at '^' marker
Here, you can choose to bind MAC ACL with the port or modify
to IP ACL rule for binding.
The hardware resources are
not enough.
When the system is configured with lots of ACLs enabled on
the object, he hardware resources are limited, for example, one
port can be bound with only 256 ACEs, so it may appear that
the hardware resources are not enough and enabling ACL on
the object fails. For example, port 0/0/2 and port 0/0/3 are
