Access-list question

rvf500 · ‎03-22-2004

We have an issue with a device on a route receiving TCP resets whenever a connection is attempted. This route goes through a third party. We have removed all blocks on our part of the network. My question is, how do access-lists deal with denied packets. Do they direct the packet to Null0 and simply drop the packet or would an extended access-list denying on a TCP rule send a reset thereby closing the connection? My own feeling is that there may be a firewall rule in the way as the reset is at layer 4. Would apprecieate some clarification.

Thanks.

Steve.

keith.campbell · ‎03-22-2004

Denied packets are dropped by access lists (and logged if configured to do so).

Standard access lists just look at the addressing, extended access lists look at the TCP port etc.

to decide to pass through the list or to drop.

It sounds as if the TCP reset is coming from the remote end

best of luck

Harold Ritter · ‎03-22-2004

Additionally a packet being denied by tha ACL causes the router to send a ICMP message (code 3(destination unreachable ), subcode 13(Communication Administratively Prohibited) to the source of the packet).

Hope this helps,

Harold Ritter
Sr Technical Leader
CCIE 4168 (R&S, SP)
harold@cisco.com
México móvil: +52 1 55 8312 4915
Cisco México
Paseo de la Reforma 222
Piso 19
Cuauhtémoc, Juárez
Ciudad de México, 06600
México

rvf500 · ‎03-22-2004

Thanks guys, yes that has helped us out. The ICMP returns helped us to look in the right direction to sort this.

k.siu · ‎04-01-2004

Dear all

I add ACl at interface.But logging this message.

136.136.1.1 is a router interface.

Why source interface is router ip not is PC address.

%SEC-6-IPACCESSLOGDP: list 2302 denied icmp 136.136.1.1 -> 151.199.214.230 (3/13), 2 packets

%SEC-6-IPACCESSLOGDP: list 2302 denied icmp 136.136.1.1 -> 130.85.193.10 (3/13), 1 packet

%SEC-6-IPACCESSLOGDP: list 2302 denied icmp 136.136.1.1 -> 12.222.154.63 (3/13), 1 packet

Extended IP access list 2302

permit ip 136.136.1.0 0.0.0.255 136.136.0.0 0.0.255.255

deny ip 136.136.1.0 0.0.0.255 any log-input (20351 matches)

permit ip any any (48654 matches)

thank you