How to Troubleshoot and Resolve ACL issues

Certification: Cisco CCNA Routing and Switching - Cisco Certified Network Associate Routing and Switching

ACLs are referred to as Access Control Lists. The primary purpose of an ACL is to filter the traffic which is passing through a device. The device makes use of ACL to figure out which data packets are permitted and which are supposed to be restricted. ACL will hold all the information regarding the data packets which have to be permitted. Based on the address information on each data packet, the device will consult the ACL to figure out whether the data packet has to be permitted over the network or not. There are basically two kinds of filtering used in ACL; IP ACLs and MAC ACLs. IP ACLs allows the data packets to be transmitted based on the IP Addresses from which they are sent or to where they have to be sent. Similarly, MAC ACLs apply to MAC addresses of devices in a network.

Even though the process is quite essential in the flow of data, there are certain issues which make the traffic behave unusually. Due to these problems, the required data packets might be restricted or the important ones could be transmitted over the network leading to leakage of important information. In this regard, it becomes very important to devise ways to troubleshoot and resolve these issues. Following, you will find various ways in which you can identify and troubleshoot these problems.

Identifying Interfaces having ACLs

Whenever you experience issues with your network and you feel that it is related to ACLs, this is the first step which you should perform. You should check all the router configurations to check whether the ACLs have been applied on them or not. It might be possible that you are not using ACL at all in your network, which means that there is no point trying to go through these steps. However, if you find out that ACLs are being used, you should get to know on which interfaces they are being used. It is important because this information will let you know where you have to divert your attention. There are a number of commands which could allow you to get accesses to this information and use it for your purpose.

You can use the command “show IP interface” to get information regarding the ACLs which have been configured on the network. You will get a complete summary of the number of ACLs and where they are configured. In addition to this, you can also make use of “show run”command to get access to the interfaces on which ACL has been configured.

Identify the ACL creating issues

Once you identify the interfaces, the next step for you is to figure out which ACL is having issues which have led to problems in the network. This is important because you cannot solve the issue unless you know the root of the problem. Once you identify that which ACL is the one experiencing problems, you will be able to carry out the further tasks to eliminate the problem. There are certain commands which you can use to get to know information regarding the ACLs to see which ones are causing problems.

You can use the command “show access-list summary” to get all the information regarding the ACLs. You will get details which will enable you to judge where the problem is. You can also make use of “show IP access-list summary” in this regard if IP ACL has been applied on the devices in the network.

However, before we have a look at the process of troubleshooting, there are certain facts which you should keep in mind to be able to resolve the issue. ACLs are included in a network according to the process of first-match logic. This means that the ACL which has been assigned first will entertain the requests first. For example, ACL 8 will get processed before ACL 9 as it has been assigned first. This process is the one which provides you ease in figuring out where the actual problem lies.

Analyzing the ACLs

Once you have identified the specific ACL causing issues, you have to analyze in depth to find the root of the problem. In this regard, you have to identify the traffic which is being sent over it. The traffic could be ICMP, UDP or TCP. Once you identify the traffic, the next thing which you need to do is to find out the issue which could be altering the traffic and making it behave in an unusual manner. If the ACL is not functioning properly due to which this traffic is not being transmitted properly, you need to adjust the rules of ACL and make sure that the settings are done correctly.

Taking the Final step

Once you have gone through all of the processes to identify the root of the problem, it is time that you take the final step to eliminate the issue. Now, at this instance, there are two paths which you could opt for. Firstly, you can reconfigure the ACL that was either denying the traffic or transmitting unusual traffic. This reconfiguration would enable it to perform perfectly. You can then check the network to see if it is working fine. However, in case you cannot get to the root of the problem, there is another thing you can do. You can remove the ACL that was causing issues. Of course you will do this in case there is least amount of ACLs having some fault. Removing the faulty ACL would ensure that the network starts working properly again. Finally, you can again check the network to see if it is working properly. However, in case the network is not resolved after performing all of these steps, then you should consider starting all over again from the beginning.

Related IT Guides