{"id":384,"date":"2010-03-11T17:12:46","date_gmt":"2010-03-11T17:12:46","guid":{"rendered":"http:\/\/mccltd.net\/blog\/?p=384"},"modified":"2010-03-11T17:13:58","modified_gmt":"2010-03-11T17:13:58","slug":"troubleshooting-ios-firewall","status":"publish","type":"post","link":"http:\/\/darenmatthews.com\/blog\/?p=384","title":{"rendered":"Troubleshooting IOS Firewall"},"content":{"rendered":"

<\/span><\/p>\n

  • If too much traffic is denied by the IOS Firewall, study the logic of your list or try to \t\tdefine an additional broader list, and then apply it instead. For example:<\/li>\n
  • \n
    \n
    access-list # permit tcp any any\r\naccess-list # permit udp any any\r\naccess-list # permit icmp any any\r\nint <interface>\r\nip access-group # in|out<\/strong><\/pre>\n<\/blockquote>\n<\/li>\n
  • The show ip access-lists<\/strong> command shows \t\twhich access lists are applied and what traffic is denied by them. If  you look \t\tat the packet count denied before and after the failed operation with  the \t\tsource and destination IP address, this number increases if the access  list \t\tblocks traffic.<\/li>\n
  • If the router is not heavily loaded, debugging can be done at a \t\tpacket level on the extended or ip inspect access list. If the router  is \t\theavily loaded, traffic is slowed through the router. Use discretion  with \t\tdebugging commands.Temporarily add the no ip route-cache<\/strong> command to the interface:
    \n
    \n
    int <interface>\r\nno ip route-cache<\/strong><\/pre>\n<\/blockquote>\n
    Then, in enable (but not config) mode:<\/p>\n
    \n
    term mon\r\ndebug ip packet # det<\/strong><\/pre>\n<\/blockquote>\n
    produces output similar to this:<\/p>\n
    \n
    *Mar 1 04:38:28.078: IP: s=10.31.1.161 (Serial0), d=171.68.118.100 (Ethernet0),\r\n   g=10.31.1.21, len 100, forward\r\n*Mar 1 04:38:28.086: IP: s=171.68.118.100 (Ethernet0), d=9.9.9.9 (Serial0), g=9.9.9.9,\r\n   len 100, forward<\/pre>\n<\/blockquote>\n<\/li>\n
  • Extended access lists can also be used with the “log” option at the \t\tend of the various statements:
    \n
    \n
    access-list 101 deny ip host 171.68.118.100 host 10.31.1.161 log\r\naccess-list 101 permit ip any any<\/strong><\/pre>\n<\/blockquote>\n
    You therefore see messages on the screen for permitted and denied \t\ttraffic:<\/p>\n
    \n
    *Mar 1 04:44:19.446: %SEC-6-IPACCESSLOGDP: list 111 permitted icmp 171.68.118.100\r\n   -> 10.31.1.161 (0\/0), 15 packets\r\n*Mar  1 03:27:13.295: %SEC-6-IPACCESSLOGP: list 118 denied tcp 171.68.118.100(0)\r\n   -> 10.31.1.161(0), 1 packet<\/pre>\n<\/blockquote>\n<\/li>\n
  • If the ip inspect list is suspect, the debug ip inspect \t\t<type_of_traffic><\/strong> command produces output such as this \t\toutput:
    \n
    \n
    Feb 14 12:41:17 10.31.1.52 56: 3d05h: CBAC* sis 258488 pak 16D0DC TCP P ack 3195751223\r\n   seq 3659219376(2) (10.31.1.5:11109) => (12.34.56.79:23)\r\nFeb 14 12:41:17 10.31.1.52 57: 3d05h: CBAC* sis 258488 pak 17CE30 TCP P ack 3659219378\r\n   seq 3195751223(12) (10.31.1.5:11109) <= (12.34.56.79:23)<\/pre>\n<\/blockquote>\n<\/li>\n
  • Source<\/a><\/li>\n","protected":false},"excerpt":{"rendered":"
    If too much traffic is denied by the IOS Firewall, study the logic of your list or try to define an additional broader list, and then apply it instead. For example:<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[83,13],"tags":[24],"_links":{"self":[{"href":"http:\/\/darenmatthews.com\/blog\/index.php?rest_route=\/wp\/v2\/posts\/384"}],"collection":[{"href":"http:\/\/darenmatthews.com\/blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/darenmatthews.com\/blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/darenmatthews.com\/blog\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/darenmatthews.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=384"}],"version-history":[{"count":4,"href":"http:\/\/darenmatthews.com\/blog\/index.php?rest_route=\/wp\/v2\/posts\/384\/revisions"}],"predecessor-version":[{"id":388,"href":"http:\/\/darenmatthews.com\/blog\/index.php?rest_route=\/wp\/v2\/posts\/384\/revisions\/388"}],"wp:attachment":[{"href":"http:\/\/darenmatthews.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=384"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/darenmatthews.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=384"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/darenmatthews.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=384"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}