access-list counters on 3560

[george_daly]

Hi,

I'm looking into using policy maps and class maps on a 3560. I've got 2 access-lists. When a packet matches access-list 1 I want it to be policed to bandwidth X, any other traffic should hit access-list 2 which is policed to bandwidth Y.

I *think* everything is working as it should be, but wanted to confirm this by checking the access list counters and/or by looking at debug output.

However I'm not seeing any hits against either access list, I think this is because traffic is being hardware switched.

Same goes for 'debug ip packet X'.

Does anyone know of a way to see hits against access-lists where the packet is being hardware switched, or of any other useful debug type commands that will achieve my aims?

Many thanks for any replies!

[george_daly]

Sorry, I should have posted this in LAN switching and routing. Will post in there, please feel free to ignore this!

[royalblues]

Hi

according to cisco the access-list hit counts are not seen when they are hardware switched

as far as the debug output the packets that are being fast switched are not taken into account. You may have to disable fast switching on the interface to get the debug output.

(config-if )#no ip route-cache

(config-if )#no ip route-cache cef

regards

narayan