Hi! This forum is my last hope to get replies for my questions.
I have a Catalyst 6506-E:
1 48 48-port 10/100/1000 RJ45 EtherModule WS-X6148A-GE-TX
2 48 48-port 10/100/1000 RJ45 EtherModule WS-X6148A-GE-TX
3 3 Network Analysis Module WS-SVC-NAM-1
5 9 Supervisor Engine 32 8GE (Active) WS-SUP32-GE-3B
6 9 Supervisor Engine 32 8GE (Hot) WS-SUP32-GE-3B
I have some network 192.168.1.0/24 (VLAN 192) and one other network 10.1.1.0/24
192.168.1.20 - ftp-client
10.1.1.100 - ftp-server
Cat 65 contains an intervaces vlan 192,10:
ip address 192.168.1.1 255.255.255.0
ip access-group 192 in
ip address 10.1.1.0 255.255.255.0
Extended IP access list 192
10 permit tcp 192.168.1.0 0.0.0.127 host 10.1.1.100 eq ftp
20 permit tcp 192.168.1.0 0.0.0.127 host 10.1.1.100 eq ftp-data
30 permit icmp any any echo
40 permit icmp any any echo-reply
50 permit icmp any any traceroute
60 deny ip any any
While ftp-client tries to connect at ftp-server, ftp-server requests username and password, and when Client chose a file to download it Server shows an error.
If in ACL 192 to enter following:
5 permit ip 192.168.1.0 0.0.0.127 host 10.1.1.100
client can download files only in passive mode.
If I remove ACL from interface VLAN 192 client also can download files only in passive mode.
What's wrong ?
Cat 6506-E ACLs counters don't increase correctly. In other words if I connect to ftp-server or I simply do ping then ALC's counters don't increase, but ACL executes. And you can't know ACL have worked correctly or not. But if ACL drops something it will increase counter corretly.
What's up ???
It's not to do with the supervisor 32 or the supervisor 720. It's about how the 6500 process acl's. You will see counters increase but not for every packet.
Attached is a link to the relevant bit of the 6500 documentation. It explains how the 6500 process acl's and where they get processed ie. hardware or software.
Just to highlight the last point in the doc above
"When you enter the show ip access-list command, the match count displayed does not include packets processed in hardware"