Strange access list debug output

Unanswered Question
Oct 18th, 2007
User Badges:

I have a router interface configured with the following access list:

access-list 101 permit tcp any any eq 23

access-list 101 deny ip any any


effectively, telnet is allowed and all other protocols are denied. when I start a debug on this access-list (debug ip packet list 101 detailed) and start telnetting to the router, everything works (as it should). But when I look with "show ip access list" I see there are about 30 matches on the "...eq 23" rule, which is correct, but there are also around 30 matches on the deny ip any any rule. The debug output shows only port 23 traffic and return traffic.

My question: what packets hit the "deny ip any any" rule when starting a telnet session?

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Loading.
Jon Marshall Thu, 10/18/2007 - 01:07
User Badges:
  • Super Blue, 32500 points or more
  • Hall of Fame,

    Founding Member

  • Cisco Designated VIP,

    2017 LAN, WAN

Hi


Could be a name resolution issue but the easiest way to check would be to change your second line in the access-list to


access-list 101 deny ip any any log


HTH


Jon

Actions

This Discussion