Strange access list debug output

Unanswered Question
Oct 18th, 2007

I have a router interface configured with the following access list:

access-list 101 permit tcp any any eq 23

access-list 101 deny ip any any

effectively, telnet is allowed and all other protocols are denied. when I start a debug on this access-list (debug ip packet list 101 detailed) and start telnetting to the router, everything works (as it should). But when I look with "show ip access list" I see there are about 30 matches on the "...eq 23" rule, which is correct, but there are also around 30 matches on the deny ip any any rule. The debug output shows only port 23 traffic and return traffic.

My question: what packets hit the "deny ip any any" rule when starting a telnet session?

I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Loading.
Jon Marshall Thu, 10/18/2007 - 01:07

Hi

Could be a name resolution issue but the easiest way to check would be to change your second line in the access-list to

access-list 101 deny ip any any log

HTH

Jon

Actions

This Discussion