Troubleshooting
Unusual Network Activity
Error (Invalid input) when entering an IP address.
When using the “host” option in the command syntax, ensure that you are not
including a mask in either dotted decimal or CIDR format. Using the “host”
option implies a specific host device and therefore does not permit any mask
entry.
Correct.
Incorrect. No mask needed
to specify a single host.
Figure C-2. Examples of Correctly and Incorrectly Specifying a Single Host
Apparent failure to log all “Deny” Matches.
Where the log statement is included in multiple ACEs configured with a “deny”
option, a large volume of “deny” matches generating logging messages in a
short period of time can impact switch performance. If it appears that the
switch is not consistently logging all “deny” matches, try reducing the number
of logging actions by removing the log statement from some ACEs configured
with the “deny” action.
The switch does not allow any routed access from a specific host, group
of hosts, or subnet.
The implicit deny any function that the switch automatically applies as the last
entry in any ACL may be blocking all access by devices not specifically
permitted by an entry in an ACL affecting those sources. If you are using the
ACL to block specific hosts, a group of hosts, or a subnet, but want to allow
any access not specifically permitted, insert permit any as the last explicit entry
in the ACL.
The switch is not performing routing functions on a VLAN
Two possible causes of this problem are:
■ Routing is not enabled. If show running indicates that routing is not
enabled, use the ip routing command to enable routing.
■ On a switch covered in this guide, an ACL may be blocking access
to the VLAN. Ensure that the switch’s IP address on the VLAN is not
blocked by one of the ACE entries in an ACL applied to that VLAN. A
common mistake is to either not explicitly permit the switch’s IP
address as a DA or to use a wildcard ACL mask in a deny statement
C-11
To Next Page
Loading...
Need help?
General