ACL counter

[inay]

Hi all

I have a Catalyst 6509 switch. I'just migrated from SUP1A-MSFC to SUP 720. I have copied my working ACL's onto the new platform. Now some of my access lists are not working or the counters doesn't increment.

here is an example:

ip access-list extended Vlan7
remark permitted
permit tcp any any eq smtp
permit tcp any any eq pop3
permit tcp any any eq www
permit tcp any any eq ftp
permit tcp any any eq 106
remark *************
remark icmp
deny icmp any any fragments
permit icmp any any packet-too-big
permit icmp any any time-exceeded
permit icmp any any echo-reply
permit icmp host x.x.x.x any echo
permit icmp host x.x.x.x any echo
permit icmp x.x.x.x 0.0.0.255 any echo
deny icmp any any echo
remark **************
remark cancelled
permit tcp any host x.x.x.x eq 22
permit tcp any host x.x.x.x eq 22
permit tcp any host x.x.x.x eq 22
permit tcp any host x.x.x.x eq 22
permit tcp x.x.x.x 0.0.0.255 any eq 22
deny tcp any any eq 22 log
deny tcp any any eq telnet
deny tcp any any eq 1434
deny tcp any any eq 1900
deny udp any any eq 1433
deny udp any any eq 1434
deny udp any any eq 1900
deny tcp any any eq 139 log
deny tcp any any eq 135
permit ip any any

This Vlan belongs to e-mail servers but there is no increment on the counter of the line "permit tcp any any eq smtp" nor "permit ip any any". I ?think when I boot the switch it works for a little while cause I see a little count on those lines like 40-50 hits. Then they stop counting. This Vlan has a 1-2 Mbit constant traffic on it. On the other hand some other ACL's work fine.

I'm not sure that my ACL's work. How can I solve this problem

Inay

 

[ciscofreak1241]

Hmmm, this looks familiar, questions...

- What do you have for the configuration under Vlan7?
- What is the CPU usage (average) for process and interrupt runtimes?
- Do you have logging enabled and is there anything there?
- What is your current IOS running on your Sup720?
- Do you have any switching methods/paths enabled (e.g. CEF, Fast Switching, etc)
- Which ACLs are working consistently?
- Which ACLs are not working consistently?

cf

 

[jneiberger]

We used to have a bug on a 6513 SUP2/MSFC2 that caused this type of problem. We upgraded the IOS and that fixed the counters.

John