S e n d d o c u m e n t a t i o n c o m m e n t s t o m d s f e e d b a c k - d o c @ c i s c o . c o m
21-6
Cisco MDS 9000 Family Troubleshooting Guide, Release 3.x
OL-9285-05
Chapter 21 Troubleshooting IP Access Lists
IP-ACL Issues
Step 6
Set the IP address, subnet mask, and protocol.
Step 7
Select
permit
or
deny
from the Action drop-down menu and click
Next
.
Step 8
Check the switches that you want to apply this ACL to and click
Finish.
Re-creating IP-ACLs Using the CLI
To r-create an IP-ACL using the CLI, follow these steps:
Step 1
Use the
show interface
command to determine which interfaces use the ACL.
switch# show interface gigabitethernet 2/1
GigabitEthernet2/1 is up
Hardware is GigabitEthernet, address is 0005.3001.a706
Internet address(es):
4000::1/64
fe80::205:30ff:fe01:a706/64
MTU 2300 bytes
Port mode is IPS
Speed is 1 Gbps
Beacon is turned off
Auto-Negotiation is turned on
ip access-group TCPAlow in
5 minutes input rate 0 bits/sec, 0 bytes/sec, 0 frames/sec
5 minutes output rate 0 bits/sec, 0 bytes/sec, 0 frames/sec
1916 packets input, 114960 bytes
0 multicast frames, 0 compressed
0 input errors, 0 frame, 0 overrun 0 fifo
0 packets output, 0 bytes, 0 underruns
0 output errors, 0 collisions, 0 fifo
0 carrier errors
Step 2
Use the
no ip access-group
or the
no ipv6 traffic-filter
command in interface mode to remove the ACL
from the interface. Repeat this step for all interfaces found in
Step 1
.
switch(config)# interface gigabitethernet 2/1
switch(config-if)#
no
ip access-group TCPAlow
Step 3
Use the
no ip access-list
or the
no ipv6 access-list
command to delete the access list and all filters
associated with it.
switch(config)#
no
ip access-list TCPAlow
Note
We recommend deleting an ACL and re-creating it because you cannot change the order of filters in an
ACL.
