Skip to content
Log in Sign up My account

3.2.a and 3.2.b Troubleshooting IPv4 ACLs and IPv6 Traffic Filters

Blueprint 3.2: Troubleshoot router security features

  • 3.2.a IPv4 access control lists: standard, extended, time-based
  • 3.2.b IPv6 traffic filter

uRPF (3.2.c) is on its own page: uRPF.

The verb is troubleshoot. ACL questions on ENARSI almost always show show access-lists output with match counters, or an interface with an ACL applied, and ask why a flow is (or is not) blocked. Read the counters: they tell you which line a flow hits.

The processing rules that cause most faults

Every ACL fault on the exam comes back to one of these rules.

  1. Top down, first match wins. Once a packet matches a line, the action is taken and no further lines are checked.
  2. Implicit deny at the end. An IPv4 ACL ends with an invisible deny ip any any. It has no counter, so traffic dropped by it does not show in show access-lists.
  3. One ACL per interface, per direction, per protocol. Applying a second IPv4 ACL inbound on the same interface replaces the first.
  4. Direction is from the router's point of view. in filters packets arriving on the interface before routing. out filters packets leaving the interface after routing.
  5. Outbound ACLs do not filter traffic the router generates itself. Pings, routing updates and syslog messages the router originates bypass an outbound interface ACL.
  6. An ACL applied to an interface but not defined permits everything. A typo in the ACL name on the interface silently disables filtering.
graph LR
  P["Packet arrives Gi0/1"] --> IN{"Inbound ACL<br/>on Gi0/1?"}
  IN -->|"deny"| D1["Drop"]
  IN -->|"permit or none"| RT["Routing lookup"]
  RT --> OUT{"Outbound ACL<br/>on exit Gi0/2?"}
  OUT -->|"deny"| D2["Drop"]
  OUT -->|"permit or none"| TX["Transmit"]
  LOC["Router-generated packet"] --> RT2["Routing lookup"] --> TX2["Transmit, outbound ACL not applied"]

Standard versus extended

Standard Extended
Numbers 1 to 99, 1300 to 1999 100 to 199, 2000 to 2699
Matches on Source address only Protocol, source, destination, ports, flags, DSCP, TTL and more
Placement guideline Close to the destination Close to the source
Typical extra use VTY access-class, route filtering, NAT, SNMP communities Interface filtering, QoS and CoPP classification, PBR

Placement follows from what each type can match. A standard ACL near the source blocks that source to every destination, which is almost never what the requirement says. An extended ACL can name the destination, so put it near the source and drop unwanted traffic before it crosses the network.

Wildcard masks

A wildcard mask bit of 0 means "must match", a 1 means "ignore". For a contiguous block, the wildcard is the subnet mask inverted: /24 is 0.0.0.255, /22 is 0.0.3.255, /30 is 0.0.0.3. host 10.1.1.1 equals 10.1.1.1 0.0.0.0, and any equals 0.0.0.0 255.255.255.255.

Common wildcard faults on the exam:

Written What it actually matches Usually intended
10.1.1.0 255.255.255.0 Any address ending in .0, from any network 10.1.1.0 0.0.0.255
10.1.4.0 0.0.1.255 10.1.4.0 to 10.1.5.255 Correct for a /23
10.1.5.0 0.0.3.255 IOS rewrites it to 10.1.4.0 0.0.3.255 Check what the running config shows
172.16.0.0 0.0.255.255 for 172.16.0.0/12 Only 172.16.0.0/16 172.16.0.0 0.15.255.255

Exam trap

In an extended ACL the port belongs to the address it follows. permit tcp any eq 22 host 10.0.0.1 matches packets from source port 22, which are SSH replies. A client connecting to an SSH server uses destination port 22: permit tcp any host 10.0.0.1 eq 22. Reversed ports are the most common single fault in ACL and CoPP exhibits.

Useful extended ACL keywords

Keyword Matches
established TCP segments with ACK or RST set, which is return traffic of a session started on the other side
eq, neq, lt, gt, range Port operators
log, log-input Generates a syslog message on match (rate limited); log-input adds the input interface and MAC
fragments Non-initial fragments, which carry no Layer 4 header
dscp, precedence, ttl Header fields
echo, echo-reply, unreachable and other ICMP types Specific ICMP messages

When an ACL denies everything not explicitly permitted, it also blocks traffic people forget about: OSPF (IP protocol 89) and EIGRP (protocol 88) on an inbound routing interface, BGP (TCP 179) in both directions, DHCP (UDP 67 and 68), DNS replies, ICMP unreachables needed for path MTU discovery, and IPsec (UDP 500, UDP 4500 and ESP, protocol 50).

Configuring and editing ACLs

ip access-list extended FROM-BRANCH
 10 permit ospf any any
 20 deny   tcp host 10.20.5.25 any eq 22
 30 permit tcp 10.20.0.0 0.0.255.255 10.99.0.0 0.0.0.255 eq 443
 40 permit icmp 10.20.0.0 0.0.255.255 any
 50 deny   ip any any log
!
interface GigabitEthernet0/1
 ip access-group FROM-BRANCH in

access-list 10 remark Management stations only
access-list 10 permit 192.168.100.0 0.0.0.255
access-list 10 deny   any log
!
line vty 0 15
 access-class 10 in

ip access-list extended FROM-BRANCH
 15 deny tcp host 10.20.5.26 any eq 22
 no 50
!
ip access-list resequence FROM-BRANCH 10 10

Named and numbered ACLs both accept sequence numbers when edited in ip access-list mode. Inserting a line between 10 and 20 is just 15 .... Re-entering access-list 101 ... in global configuration always appends to the end.

Verification

R1# show access-lists FROM-BRANCH
Extended IP access list FROM-BRANCH
    10 permit ospf any any (4021 matches)
    20 deny tcp host 10.20.5.25 any eq 22 (14 matches)
    30 permit tcp 10.20.0.0 0.0.255.255 10.99.0.0 0.0.0.255 eq www (0 matches)
    40 permit icmp 10.20.0.0 0.0.255.255 any (230 matches)
    50 deny ip any any log (1882 matches)

R1# show ip interface GigabitEthernet0/1 | include access list
  Outgoing access list is not set
  Inbound  access list is FROM-BRANCH

Line 30 is the clue in this output. The requirement was HTTPS, but IOS displays port 80 as www, so someone typed eq 80 or eq www and the line permits HTTP instead. More generally, a line that should be busy and has zero matches is mistyped, shadowed by an earlier line, or applied on the wrong interface or in the wrong direction.

A troubleshooting routine for any ACL ticket:

  1. show ip interface <int> | include access list: is the right ACL applied, in the right direction, on the right interface?
  2. show access-lists <name>: does the ACL exist with that exact name? Which line has the counters?
  3. clear access-list counters <name>, reproduce the problem, then look again. The line whose counter moved is the line the flow hit.
  4. If no line moved, the flow is either hitting the implicit deny (add an explicit deny ip any any log temporarily) or not passing this interface at all (check routing).

Exam trap

ip access-group BRANCH-IN in with an ACL actually named FROM-BRANCH is accepted without an error. The interface points to a list that does not exist, so all traffic is permitted. show ip interface shows the name you typed, so compare it letter for letter with show access-lists.

Time-based ACLs

A time range lets one ACL entry be active only during a window. The ACL entry references the range by name.

clock timezone EST -5 0
ntp server 10.50.1.5
!
time-range BUSINESS
 periodic weekdays 8:00 to 18:00
time-range MAINT-WINDOW
 absolute start 22:00 10 October 2026 end 04:00 11 October 2026
!
ip access-list extended GUEST-IN
 10 permit tcp 10.50.0.0 0.0.0.255 any eq 443 time-range BUSINESS
 20 permit udp 10.50.0.0 0.0.0.255 any eq 53
 30 deny   ip any any
Element Rules
periodic Recurring window. Keywords: a day name, daily, weekdays (Monday to Friday), weekend (Saturday and Sunday). Several periodic lines are allowed.
absolute One-off window with start and/or end. Only one absolute statement per time range. If both are present, a periodic window is active only inside the absolute window.
Clock source The router's own clock and time zone. NTP keeps it right.
Display show time-range and show access-lists mark entries (active) or (inactive) 
R1# show time-range
time-range entry: BUSINESS (inactive)
   periodic weekdays 8:00 to 18:00
   used in: IP ACL entry
time-range entry: MAINT-WINDOW (inactive)
   absolute start 22:00 10 October 2026 end 04:00 11 October 2026
   used in: IP ACL entry

R1# show clock
*03:12:44.019 UTC Sat Jan 2 2027

Two faults are visible here. The clock shows UTC with an asterisk, meaning it is not synchronised and no time zone is configured, so the business-hours window is evaluated against the wrong time. And MAINT-WINDOW is an absolute range that has already ended, so any entry using it will never be active again.

Exam trap

A time-based entry that is inactive is skipped, not denied. The packet continues down the ACL. Whether it is then dropped depends on the later lines. If the next line is deny ip any any, the effect is a deny; if it is a broad permit, the time range had no effect at all.

IPv6 traffic filters

IPv6 ACLs look similar but differ in ways the exam likes to test.

IPv4 ACL IPv6 ACL
Naming Numbered or named Named only
Addresses Address and wildcard Prefix and length, e.g. 2001:DB8:10::/64
Applied to an interface ip access-group NAME in ipv6 traffic-filter NAME in
Applied to VTY lines access-class NAME in ipv6 access-class NAME in
Standard versus extended Separate types One type, always extended
Implicit entries at the end deny ip any any permit icmp any any nd-na, permit icmp any any nd-ns, deny ipv6 any any

Why the implicit ND permits matter

IPv6 has no ARP. Neighbor Solicitation (NS) and Neighbor Advertisement (NA) messages replace it, and they are ICMPv6. The two implicit permits keep address resolution working under a restrictive ACL. Any explicit deny ipv6 any any that you add is placed above the implicit lines and removes that protection. Neighbor cache entries then age out, and the link fails a few minutes after the ACL was applied.

The implicit permits cover only NS and NA. They do not cover:

Traffic Why you might need it Match
Router Solicitation and Router Advertisement A router interface that learns its address or default route by SLAAC from upstream, or hosts sending RS to the router permit icmp any any router-advertisement, permit icmp any any router-solicitation
Packet Too Big Path MTU discovery. IPv6 routers do not fragment, so blocking it breaks large transfers permit icmp any any packet-too-big
OSPFv3 Hellos to FF02::5 from link-local addresses permit 89 FE80::/10 any
EIGRP for IPv6 Hellos to FF02::A from link-local addresses permit 88 FE80::/10 any
DHCPv6 Client to server on UDP 547, server to client on UDP 546 permit udp any any eq 547 
ipv6 access-list LAN-IN
 sequence 10 permit icmp any any nd-ns
 sequence 20 permit icmp any any nd-na
 sequence 30 permit icmp any any router-solicitation
 sequence 40 permit udp any any eq 547
 sequence 50 permit tcp 2001:DB8:10::/64 any eq 443
 sequence 60 permit icmp 2001:DB8:10::/64 any
 sequence 70 deny ipv6 any any log
!
interface GigabitEthernet0/1
 ipv6 address 2001:DB8:10::1/64
 ipv6 traffic-filter LAN-IN in
!
line vty 0 15
 ipv6 access-class MGMT6 in

R1# show ipv6 access-list LAN-IN
IPv6 access list LAN-IN
    permit icmp any any nd-ns (311 matches) sequence 10
    permit icmp any any nd-na (296 matches) sequence 20
    permit icmp any any router-solicitation (4 matches) sequence 30
    permit udp any any eq 547 (12 matches) sequence 40
    permit tcp 2001:DB8:10::/64 any eq 443 (9120 matches) sequence 50
    permit icmp 2001:DB8:10::/64 any (88 matches) sequence 60
    deny ipv6 any any log (41 matches) sequence 70

R1# show ipv6 interface GigabitEthernet0/1 | include access list
  Input features: Access List
  Inbound access list LAN-IN

Exam trap

An IPv6 ACL on an interface that runs OSPFv3 must allow traffic from link-local sources. A line such as permit 89 2001:DB8::/32 any looks right but matches nothing, because OSPFv3 packets are sourced from FE80:: addresses. The adjacency never forms, and show ospfv3 neighbor is empty.

Lab: ACL break/fix

Topology

graph LR
  LAN1["Lo10 10.10.10.1/24<br/>2001:db8:10::1/64"] --- R1
  R1 -- "Gi0/0 .1  10.1.2.0/30  .2 Gi0/0<br/>2001:db8:1:2::/64" --- R2
  R2 -- "Gi0/1 .1  10.2.3.0/30  .2 Gi0/1<br/>2001:db8:2:3::/64" --- R3
  R3 --- SRV["Lo30 10.3.30.1/24<br/>2001:db8:30::1/64"]

Run OSPFv2 and OSPFv3 area 0 on every interface. R1's loopback stands in for a user LAN, R3's loopback for a server LAN. Enable ip http server and ip http secure-server on R3 so TCP 80 and 443 answer, and enable SSH on R3. Generate traffic from R1 with telnet 10.3.30.1 80 /source-interface Loopback10 and ping 10.3.30.1 source Loopback10.

Requirement: from the user LAN to the server LAN, permit HTTPS and ICMP only. SSH to the servers is allowed from the user LAN only during business hours. Routing must stay up.

Steps

  1. Configure NTP or set the clock and time zone on R2 so show clock is correct.

  2. On R2, build and apply the baseline policy inbound on Gi0/0:

    time-range BUSINESS
 periodic weekdays 8:00 to 18:00
ip access-list extended USERS-IN
 10 permit ospf any any
 20 permit tcp 10.10.10.0 0.0.0.255 10.3.30.0 0.0.0.255 eq 443
 30 permit tcp 10.10.10.0 0.0.0.255 10.3.30.0 0.0.0.255 eq 22 time-range BUSINESS
 40 permit icmp 10.10.10.0 0.0.0.255 10.3.30.0 0.0.0.255
 50 deny ip any any log
interface GigabitEthernet0/0
 ip access-group USERS-IN in

  3. Verify: OSPF to R1 stays FULL, telnet 10.3.30.1 443 /source-interface Loopback10 connects, port 80 is refused, and show access-lists USERS-IN shows counters on lines 10, 20 and 50. Save a baseline.

  4. Break 1: remove line 10. Wait for the dead interval (40 seconds on Ethernet). Expected: %OSPF-5-ADJCHG ... Dead timer expired on R2, and line 50 counters climb with log messages for protocol 89 from 10.1.2.1 to 224.0.0.5. Restore line 10.
  5. Break 2: on Gi0/0 replace the access-group with ip access-group USER-IN in (missing S). Expected: everything is permitted, including port 80. show ip interface Gi0/0 names an ACL that show access-lists does not have. Fix the name.
  6. Break 3: change the router clock so it is a Saturday (clock set with NTP disabled). Expected: line 30 shows (inactive) and SSH falls through to line 50. Restore the clock.

  7. IPv6 part: apply this on R2 Gi0/0 and observe the result over five minutes:

    ipv6 access-list USERS6-IN
 sequence 10 permit tcp 2001:DB8:10::/64 2001:DB8:30::/64 eq 443
 sequence 20 deny ipv6 any any log
interface GigabitEthernet0/0
 ipv6 traffic-filter USERS6-IN in

    Expected: the OSPFv3 adjacency to R1 drops (link-local protocol 89 denied), and after the neighbor cache ages out even permitted HTTPS fails (NS and NA denied). Fix by adding permit 89 FE80::/10 any, permit icmp any any nd-ns and permit icmp any any nd-na ahead of sequence 20.

Expected verification output when fixed

R2# show ipv6 access-list USERS6-IN
IPv6 access list USERS6-IN
    permit 89 FE80::/10 any (52 matches) sequence 5
    permit icmp any any nd-ns (6 matches) sequence 6
    permit icmp any any nd-na (6 matches) sequence 7
    permit tcp 2001:DB8:10::/64 2001:DB8:30::/64 eq 443 (24 matches) sequence 10
    deny ipv6 any any log (17 matches) sequence 20

R2# show ospfv3 neighbor
          OSPFv3 1 address-family ipv6 (router-id 10.255.255.2)
Neighbor ID     Pri   State           Dead Time   Interface ID    Interface
10.255.255.1      1   FULL/DR         00:00:36    3               GigabitEthernet0/0

Quick check

An extended ACL is applied outbound on R1 Gi0/2 to block ICMP to a server. Pings from hosts behind R1 are blocked, but a ping from R1 itself still reaches the server. Why?

Outbound interface ACLs do not filter packets the router originates. The router's own ping is not subject to the ACL. This is expected behaviour, not a fault.

An IPv4 ACL has a permit entry that references a periodic time range. Outside the window, what happens to a packet that would have matched that entry?

The entry is inactive and is skipped. The packet is compared with the following entries. If nothing else matches, the implicit deny drops it.

Which IPv6 traffic is still permitted by the implicit entries at the end of an IPv6 ACL, and which common traffic is not?

Neighbor Solicitations and Neighbor Advertisements are permitted. Router Solicitations, Router Advertisements, Packet Too Big, routing protocols and DHCPv6 are not, and must be permitted explicitly when the ACL ends in a deny.

References