-
The switch may be running with IP routing disabled. To ensure that IP routing is enabled, execute
show runningand look for the IP routing statement in the resulting listing. For example:
![[NOTE: ]](images/note.gif)
NOTE: If an ACL assigned to a VLAN includes an ACE referencing an IP address on the switch itself as a packet source or destination, the ACE screens traffic to or from this switch address regardless of whether IP routing is enabled. This is a security measure designed to help protect the switch from unauthorized management access.
If you need to configure IP routing, execute the
ip routingcommand. -
ACL filtering on the switches applies only to routed packets and packets having a destination IP address (DA) on the switch itself.
Also, the switch applies assigned ACLs only at the point where traffic enters or leaves the switch on a VLAN. Ensure that you have correctly applied your ACLs ("in" and/or "out") to the appropriate VLANs.
The implicit deny any function that the switch automatically applies as the last entry in any ACL always blocks packets having the same DA as the switch's IP address on the same VLAN. That is, bridged packets with the switch itself as the destination are blocked as a security measure.
To preempt this action, edit the ACL to include an ACE that permits access to the switch's DA on that VLAN from the management device.
When using the "host" option in the Command syntax, ensure that you are not including a mask in either dotted decimal or CIDR format. Using the "host" option implies a specific host device and therefore does not permit any mask entry.
Where the log statement is included in multiple ACEs configured with a "deny" option, a large volume of "deny" matches generating logging messages in a short period of time can impact switch performance. If it appears that the switch is not consistently logging all "deny" matches, try reducing the number of logging actions by removing the log statement from some ACEs configured with the "deny" action.
The implicit deny any function that the switch automatically applies as the last entry in any ACL may be blocking all access by devices not specifically permitted by an entry in an ACL affecting those sources. If you are using the ACL to block specific hosts, a group of hosts, or a subnet, but want to allow any access not specifically permitted, insert permit any as the last explicit entry in the ACL.
Two possible causes of this problem are:
-
Routing is not enabled. If
show runningindicates that routing is not enabled, use theip routingcommand to enable routing. -
An ACL may be blocking access to the VLAN (on a switch covered in this guide.) Ensure that the switch's IP address on the VLAN is not blocked by one of the ACE entries in an ACL applied to that VLAN. A common mistake is to either not explicitly permit the switch's IP address as a DA or to use a wildcard ACL mask in a
denystatement that happens to include the switch's IP address.
Configuring a "deny" ACE that includes a gateway address can block traffic attempting to use the gateway as a next-hop.
Examples:
Configuring ACL "101" (ACE blocking an entire subnet) and applying it outbound on VLAN 1 in Inadvertently blocking a gateway includes the router gateway (10.0.8.1) needed by devices on other networks. This can prevent the switch from sending ARP and other routing messages to the gateway router to support traffic from authorized remote networks.
ACE blocking an entire subnet
In Inadvertently blocking a gateway, this ACE (see data in bold below) denies access to the 10 Net's 10.0.8.1 router gateway needed by the 20 Net (Subnet mask is 255.255.255.0.)
HP Switch(config)# access-list config
ip access-list extended "101"
deny ip 0.0.0.0 255.255.255.255 10.0.8.30 0.0.0.255
permit ip 0.0.0.0 255.255.255.255 0.0.0.00 255.255.255.255
exit
To avoid inadvertently blocking the remote gateway for authorized traffic from another network (such as the 20 Net in this example):
-
Configure an ACE that specifically permits authorized traffic from the remote network.
-
Configure narrowly defined ACEs to block unwanted IP traffic that would otherwise use the gateway; such ACEs might deny traffic for a particular application, particular hosts, or an entire subnet.
-
Configure a "permit any" ACE to specifically allow any IP traffic to move through the gateway.
If you use the switch as a gateway for traffic you want routed between subnets, use these general steps to avoid blocking the gateway for authorized applications:
-
Configure gateway security first for routing with specific permit and deny statements.
-
Deny any unauthorized traffic that you have not already denied in step Step 1.