Where can we confirm if an access-list is applied on an interface 2

[Krelian]

Here is an interesting one. Our consultant has setup a Cisco 2600 with serial int s0/0 and int e0/0. There is a extended access-list 199 configured with the usual statements to deny internet chats and special ports. But when I use "sh ip int" to try check which interface the access-list is applied to, I get for both interfaces s0/0 and e0/0:

Outgoing access list is not set
Inbound access list is not set

I know the access-list is being applied since users are blocked from connecting on-line or special ports for stuff like Napster, thru the router. But how is this being applied and where is this shown? Doesn't anyone have any idea?

Krelian

 

[trevorh13]

Try using the "show interface" command this will show you information for all router interfaces including Access lists that are set.

"Show access-list" and "show running-config" should also provide you with the information you require.

 

[Trimmer]

Do a show running and look at the interface configs. Look for a line that says "access-group 199 (in-out). If you do not see this, the ACL is not applied. If this is the case, do you have a firewall or another device that would do filtering. Does the router have the IP/FW IOS on it?

 

[Krelian]

Just checked "sh int" and "sh run" and there is nothing about access-group on any of the interfaces. So I guess without the access-group statement, access-list 199 is not applied on the interfaces. The only other thing the router has is NAT overload. Well, maybe Trimmer is right. Maybe there is some other device doing the filtering. Anyways, the search continues.

Krelian

 

[whacker]

I think the full command you want is "ip access-group 199 (in-out)" to apply the access list on the appropriate port.