Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

IP Interface ACLS, and CEF "receive" adjacencies

Hello,

In regards to configuring an SVI with ip address 10.10.10.1 and applying the following ACL inbound:

"permit ip 10.10.10.0 255.255.255.0 any"

Would ICMP packets destined to the SVI be forwarded for an ACL lookup or since this is a "receive" adjacency in CEF and its traffic destined to the control plane than would only rACL's or cOPP be needed for protection.

Please let me know and I can clarify further.

Thank you

2 REPLIES
Hall of Fame Super Silver

Re: IP Interface ACLS, and CEF "receive" adjacencies

Hello Thomas,

the ACL will process ICMP packets destined to the SVI and it will allow them.

but you need to write it using wildcard mask:

permit ip 10.10.10.0 0.0.0.255 any

you can test using a modified version of the ACL

access-list 111 permit icmp 10.10.10.0 0.0.0.255 host 10.10.10.1

access-list 111 permit ip 10.10.10.0 0.0.0.255 any

int vlan 10

ip address 10.10.10.1

no shut

ip access-group 111 in

!

attempting to ping 10.10.10.1 should work and you should see counters increasing in first line of ACL 111

with

sh ip access-list 111

CoPP is more smart and it can introduce a rate-limiting action to protect CPU.

Hope to help

Giuseppe

New Member

Re: IP Interface ACLS, and CEF "receive" adjacencies

Hello Giuseppe,

I'm in the process of testing this today and really appreciate the feedback.

Thank you

262
Views
5
Helpful
2
Replies