How to Troubleshoot ACL Errors
As discussed earlier, we can troubleshoot the ACL error using the show commands. The wrong-order ACEs are the most common ACL errors. This article will discuss some common errors in ACL configuration
ACL Error – Example 1
In the figure, host 192.168.2.2 has no HTTP or HTTPS access with 192.168.4.2. When entering the show access-lists command, matches are shown for the first deny statement, which indicates that traffic has matched this statement.
Now, look at the order of the entries. Host 192.168.2.2 has no connectivity with 192.168.4.2 because of the rule process ID 10 order in the access list. When the router processes ACLs from the top to down, statement 10 denies host 192.168.2.2 for TCP traffic, so statement 20 can never be matched. Statements 10 and 20 should be reversed. The third line allows all other non-TCP traffic under IP, such as ICMP, UDP, etc.
ACL Errors – Example 2
The network 192.168.2.0/24 cannot use TFTP to connect to the 192.168.4.2 server.
The 192.168.2.0/24 network cannot use TFTP to connect to 192.168.4.2 because TFTP uses UDP. However, when we use the show access-list command, the statement has no permit entry for UDP traffic.
The access list allows all other TCP traffic, and UDP is implicitly denied. The implied deny any statement does not appear in the show access-lists output, so matches are not shown. The third statement must be changed to ip any any instead of tcp any any.
ACL Errors – Example 3
In the topology in the figure, the 192.168.1.0/24 network can use Telnet to connect to 192.168.4.0/24, but this is not according to policy; this connection should not be allowed. The results of the show access-lists command show that the permit statement has been matched.
The 192.168.1.0/24 network can use Telnet because the Telnet port number in statement 10 of access-list 101 is listed incorrectly in the ACL statement.
It currently denies any source packet with a port number equal to Telnet. To deny Telnet traffic inbound on fa0/0, we need to deny the destination port number equal to Telnet. For example, deny TCP or any eq telnet.
