Monday, April 30, 2012

Verifying ACL's and Prefix-list

It has been a while since I posted anything, apologies.  I have been very very busy at work with new projects. Some simple commands to verify an ACL/Prefix-list is getting programmed correctly into the TCAM(Hardware)


6509E#show tcam interface gigabitEthernet 7/1 acl in ip detail



* Global Defaults not shared

-------------------------------------------------------------------------------------------------------------------
DPort - Destination Port   SPort - Source Port        TCP-F - U -URG             Pro   - Protocol
I     - Inverted LOU       TOS   - TOS Value                - A -ACK             rtr   - Router
MRFM  - M -MPLS Packet     TN    - T -Tcp Control           - P -PSH             COD   - C -Bank Care Flag
      - R -Recirc. Flag          - N -Non-cachable          - R -RST                   - I -OrdIndep. Flag
      - F -Fragment Flag   CAP   - Capture Flag             - S -SYN                   - D -Dynamic Flag
      - M -More Fragments  F-P   - FlowMask-Prior.          - F -FIN             T     - V(Value)/M(Mask)/R(Result)
X     - XTAG               (*)   - Bank Priority
-------------------------------------------------------------------------------------------------------------------




Interface: 1018   label: 1025   lookup_type: 0
protocol: IP   packet-type: 0

+-+-----+---------------+---------------+---------------+---------------+-------+---+----+-+---+--+---+---+
|T|Index|  Dest Ip Addr | Source Ip Addr|     DPort     |     SPort     | TCP-F |Pro|MRFM|X|TOS|TN|COD|F-P|
+-+-----+---------------+---------------+---------------+---------------+-------+---+----+-+---+--+---+---+

Entries from Bank 0

 V 17139         0.0.0.0     10.202.218.2       P=0             P=0        ------   0 ---- 0   0 -- C-- 0-0
 M 17144         0.0.0.0 255.255.255.255         0               0        ------   0 ---- 0   0
 R rslt: L3_DENY_RESULT (*)            rtr_rslt: L3_DENY_RESULT (*)                  hit_cnt=0

 V 17140         0.0.0.0  10.187.36.133       P=0             P=0        ------   0 ---- 0   0 -- C-- 0-0
 M 17144         0.0.0.0 255.255.255.255         0               0        ------   0 ---- 0   0
 R rslt: L3_DENY_RESULT (*)            rtr_rslt: L3_DENY_RESULT (*)                  hit_cnt=0

 V 17141         0.0.0.0  10.187.36.240       P=0             P=0        ------   0 ---- 0   0 -- C-- 0-0
 M 17144         0.0.0.0 255.255.255.255         0               0        ------   0 ---- 0   0
 R rslt: L3_DENY_RESULT (*)            rtr_rslt: L3_DENY_RESULT (*)                  hit_cnt=0

 V 17142         0.0.0.0  10.187.50.138       P=0             P=0        ------   0 ---- 0   0 -- C-- 0-0
 M 17144         0.0.0.0 255.255.255.255         0               0        ------   0 ---- 0   0
 R rslt: L3_DENY_RESULT (*)            rtr_rslt: L3_DENY_RESULT (*)                  hit_cnt=0

 V 17143         0.0.0.0     10.51.3.35       P=0             P=0        ------   0 ---- 0   0 -- C-- 0-0
 M 17144         0.0.0.0 255.255.255.255         0               0        ------   0 ---- 0   0
 R rslt: L3_DENY_RESULT (*)            rtr_rslt: L3_DENY_RESULT (*)                  hit_cnt=0

 V 17145         0.0.0.0   10.10.83.93       P=0             P=0        ------   0 ---- 0   0 -- C-- 0-0
 M 17153         0.0.0.0 255.255.255.255         0               0        ------   0 ---- 0   0
 R rslt: L3_DENY_RESULT (*)            rtr_rslt: L3_DENY_RESULT (*)                  hit_cnt=0

6509E#show ip prefix-list detail to-someone
ip prefix-list to-someone:
   count: 8, range entries: 0, sequences: 25 - 70, refcount: 2
   seq 25 permit 1.1.1.0/23 (hit count: 20, refcount: 1)
   seq 35 permit 10.79.105.0/24 (hit count: 20, refcount: 1)
   seq 40 permit 10.67.251.0/24 (hit count: 20, refcount: 2)
   seq 50 permit 10.55.224.0/23 (hit count: 20, refcount: 1)
   seq 55 permit 10.55.192.0/24 (hit count: 9, refcount: 1)
   seq 60 permit 10.55.193.0/24 (hit count: 1, refcount: 2)
   seq 65 permit 10.55.194.0/24 (hit count: 1, refcount: 1)
   seq 70 permit 10.55.195.0/24 (hit count: 1, refcount: 5)

Good reference Link.

http://www.i-1.nl/blog/?p=134

No comments:

Post a Comment