dt_aclcheck - Find a match in extended access list.

Some ACLs are short, some ACLs are really long!



access-list 100 permit gre host 4.2.4.66 host 4.55.3.1 access-list 100 permit ip any host 8.7.110.3 access-list 100 permit icmp any host 4.1.72.186 access-list 100 permit tcp any any eq 22 established access-list 100 permit ip host 64.251.10.175 host 8.7.108.94 access-list 100 permit tcp host 2.201.145.67 any eq telnet access-list 100 deny tcp host 202.156.182.196 host 8.7.109.70 log access-list 100 deny tcp host 202.156.2.18 host 8.7.109.70 log access-list 100 deny ip 10.0.0.0 0.255.255.255 any access-list 100 deny ip 127.0.0.0 0.255.255.255 any log access-list 100 deny ip 169.254.0.0 0.0.255.255 any access-list 100 deny ip 172.0.0.0 0.31.255.255 any access-list 100 deny ip 192.168.0.0 0.0.255.255 any access-list 100 deny ip 8.7.108.0 0.0.0.252 any log access-list 100 permit tcp host 75.149.49.36 any access-list 100 permit ip any host 8.7.111.32 access-list 100 permit ip any host 8.7.111.33 access-list 100 permit tcp host 64.251.10.175 any access-list 100 permit icmp any host 8.7.108.180 access-list 100 permit icmp any host 8.7.108.181 access-list 100 permit tcp any host 8.7.108.180 eq 443 access-list 100 permit udp any host 8.7.108.180 eq 3544 access-list 100 permit tcp any host 8.7.108.181 eq 443 access-list 100 permit udp any host 8.7.108.181 eq 3544 access-list 100 permit tcp any host 8.7.109.186 eq ftp-data access-list 100 permit tcp any host 8.7.109.186 eq ftp access-list 100 permit tcp any host 8.7.109.186 gt 1023 access-list 100 permit tcp any host 8.7.109.61 eq www access-list 100 permit icmp any host 8.7.109.61 access-list 100 permit tcp any host 8.7.109.62 eq www access-list 100 permit icmp any host 8.7.109.62 access-list 100 permit tcp any host 8.7.109.63 eq www access-list 100 permit icmp any host 8.7.109.63 access-list 100 permit tcp any host 8.7.109.64 eq www access-list 100 permit icmp any host 8.7.109.64 access-list 100 permit tcp any host 8.7.109.67 eq www access-list 100 permit icmp any host 8.7.109.67 access-list 100 permit tcp any host 8.7.109.68 eq www access-list 100 permit icmp any host 8.7.109.68 access-list 100 permit tcp any host 8.7.109.30 eq www access-list 100 permit icmp any host 8.7.109.30 access-list 100 permit tcp any host 8.7.109.21 eq www access-list 100 permit icmp any host 8.7.109.21 access-list 100 permit tcp any host 8.7.109.22 eq www access-list 100 permit icmp any host 8.7.109.22 access-list 100 permit tcp any host 8.7.109.23 eq www access-list 100 permit icmp any host 8.7.109.23 access-list 100 permit tcp any host 8.7.109.24 eq www access-list 100 permit icmp any host 8.7.109.24 access-list 100 permit tcp any host 8.7.110.21 eq www access-list 100 permit icmp any host 8.7.110.21 access-list 100 permit tcp any host 8.7.110.22 eq www access-list 100 permit icmp any host 8.7.110.22 access-list 100 permit tcp any host 8.7.110.23 eq www access-list 100 permit icmp any host 8.7.110.23 access-list 100 permit tcp any host 8.7.110.24 eq www access-list 100 permit icmp any host 8.7.110.24 access-list 100 permit tcp any host 8.7.111.106 eq 443 access-list 100 permit tcp host 69.60.116.220 host 8.7.109.179 eq www access-list 100 permit tcp host 69.60.116.221 host 8.7.109.179 eq www access-list 100 permit tcp host 69.60.116.222 host 8.7.109.179 eq www access-list 100 permit tcp host 69.60.116.223 host 8.7.109.179 eq www access-list 100 permit tcp host 69.60.116.224 host 8.7.109.179 eq www access-list 100 permit tcp host 65.111.170.190 host 8.7.109.179 eq www access-list 100 permit tcp host 65.111.170.191 host 8.7.109.179 eq www access-list 100 permit tcp host 65.111.170.192 host 8.7.109.179 eq www access-list 100 permit tcp host 65.111.170.179 host 8.7.109.179 eq www access-list 100 permit tcp host 64.251.26.117 host 8.7.109.179 eq www access-list 100 permit tcp host 64.251.26.118 host 8.7.109.179 eq www access-list 100 permit tcp host 65.111.166.64 host 8.7.109.179 eq www access-list 100 permit tcp host 65.111.166.65 host 8.7.109.179 eq www access-list 100 permit tcp host 85.13.210.66 host 8.7.109.179 eq www access-list 100 permit tcp host 85.13.208.154 host 8.7.109.179 eq www access-list 100 permit tcp host 85.13.209.34 host 8.7.109.179 eq www access-list 100 permit tcp host 85.13.205.139 host 8.7.109.179 eq www access-list 100 permit tcp host 85.13.205.140 host 8.7.109.179 eq www access-list 100 permit tcp host 85.13.205.141 host 8.7.109.179 eq www access-list 100 permit tcp host 85.13.205.142 host 8.7.109.179 eq www access-list 100 permit tcp host 203.92.34.25 host 8.7.109.179 eq www access-list 100 permit tcp host 203.92.34.26 host 8.7.109.179 eq www access-list 100 permit tcp host 64.130.221.146 host 8.7.109.179 eq www access-list 100 permit tcp host 64.130.221.147 host 8.7.109.179 eq www access-list 100 permit tcp host 111.125.163.134 host 8.7.109.179 eq www access-list 100 permit tcp host 111.125.163.135 host 8.7.109.179 eq www access-list 100 permit tcp any any eq domain access-list 100 permit udp any any eq domain access-list 100 permit icmp any host 8.7.109.93 access-list 100 permit icmp any host 8.7.109.92 access-list 100 permit icmp any host 8.7.108.11 access-list 100 permit icmp any host 8.7.108.12 access-list 100 permit tcp any host 8.7.109.73 eq www access-list 100 permit tcp any host 8.7.109.73 eq 443 access-list 100 permit icmp any host 8.7.109.73 access-list 100 permit tcp any host 8.7.109.176 eq www access-list 100 permit tcp any host 8.7.109.176 eq 443 access-list 100 permit icmp any host 8.7.109.176 access-list 100 permit tcp any host 8.7.109.29 eq www access-list 100 permit icmp any host 8.7.109.29 access-list 100 permit tcp any host 8.7.109.74 eq www access-list 100 permit icmp any host 8.7.109.74 access-list 100 permit tcp any host 8.7.109.175 eq www access-list 100 permit icmp any host 8.7.109.175 access-list 100 permit tcp any host 8.7.109.88 eq www access-list 100 permit tcp any host 8.7.109.154 eq www access-list 100 permit icmp any host 8.7.109.154 access-list 100 permit tcp any host 8.7.109.78 eq www access-list 100 permit icmp any host 8.7.109.78 access-list 100 permit tcp any host 8.7.109.155 eq www access-list 100 permit tcp any host 8.7.109.155 eq 443 access-list 100 permit icmp any host 8.7.109.155 access-list 100 permit tcp any host 8.7.109.168 eq www access-list 100 permit icmp any host 8.7.109.168 access-list 100 permit tcp any host 8.7.109.137 eq www access-list 100 permit icmp any host 8.7.109.137 access-list 100 permit tcp any host 8.7.109.138 eq www access-list 100 permit tcp any host 8.7.109.138 eq 443 access-list 100 permit tcp any host 8.7.111.108 eq www access-list 100 permit icmp any host 8.7.109.138 access-list 100 permit tcp any host 8.7.109.139 eq www access-list 100 permit tcp any host 8.7.109.139 eq 443 access-list 100 permit icmp any host 8.7.109.139 access-list 100 permit tcp 63.81.16.64 0.0.0.63 host 8.7.109.85 eq www access-list 100 permit tcp any host 8.7.109.85 eq 443 access-list 100 permit icmp any host 8.7.109.85 access-list 100 permit tcp any host 8.7.109.150 eq 443 access-list 100 permit icmp any host 8.7.109.150 access-list 100 permit tcp any host 8.7.109.86 eq 443 access-list 100 permit icmp any host 8.7.109.86 access-list 100 permit tcp any host 8.7.109.151 eq 443 access-list 100 permit icmp any host 8.7.109.151 access-list 100 permit tcp any host 8.7.109.87 eq www access-list 100 permit icmp any host 8.7.109.87 access-list 100 permit tcp any host 8.7.109.152 eq www access-list 100 permit icmp any host 8.7.109.152 access-list 100 permit icmp any host 8.7.109.88 access-list 100 permit tcp any host 8.7.109.153 eq www access-list 100 permit icmp any host 8.7.109.153 access-list 100 permit tcp any host 8.7.109.169 eq www access-list 100 permit icmp any host 8.7.109.169 access-list 100 permit tcp any host 8.7.109.170 eq www access-list 100 permit icmp any host 8.7.109.170 access-list 100 permit tcp any host 8.7.109.171 eq www access-list 100 permit icmp any host 8.7.109.171 access-list 100 permit tcp any host 8.7.109.172 eq www access-list 100 permit icmp any host 8.7.109.172 access-list 100 permit tcp any host 8.7.109.173 eq www access-list 100 permit icmp any host 8.7.109.173 access-list 100 permit tcp any host 8.7.109.174 eq www access-list 100 permit icmp any host 8.7.109.174 access-list 100 permit tcp any host 8.7.109.178 eq 443 access-list 100 permit tcp any host 8.7.109.156 eq www access-list 100 permit tcp any host 8.7.109.156 eq 443 access-list 100 permit icmp any host 8.7.109.156 access-list 100 permit tcp any host 8.7.109.162 eq www access-list 100 permit icmp any host 8.7.109.162 access-list 100 permit tcp any host 8.7.109.76 eq www access-list 100 permit icmp any host 8.7.109.76 access-list 100 permit tcp any host 8.7.109.157 eq 443 access-list 100 permit tcp any host 8.7.109.157 eq www access-list 100 permit icmp any host 8.7.109.157 access-list 100 permit tcp any host 8.7.109.163 eq www access-list 100 permit icmp any host 8.7.109.163 access-list 100 permit tcp any host 8.7.109.164 eq www access-list 100 permit icmp any host 8.7.109.164 access-list 100 permit tcp any host 8.7.109.166 eq www access-list 100 permit icmp any host 8.7.109.166 access-list 100 permit tcp any host 8.7.109.165 eq www access-list 100 permit icmp any host 8.7.109.165 access-list 100 permit tcp any host 8.7.109.190 eq 443 access-list 100 permit icmp any host 8.7.109.190 access-list 100 permit tcp any host 8.7.109.158 eq www access-list 100 permit icmp any host 8.7.109.158 access-list 100 permit tcp any host 8.7.109.159 eq www access-list 100 permit icmp any host 8.7.109.159 access-list 100 permit tcp any host 8.7.109.160 eq www access-list 100 permit icmp any host 8.7.109.160 access-list 100 permit tcp any host 8.7.109.161 eq 443 access-list 100 permit icmp any host 8.7.109.161 access-list 100 permit tcp any host 8.7.109.161 eq www access-list 100 permit tcp any host 8.7.109.70 eq www access-list 100 permit tcp any host 8.7.109.70 eq 443 access-list 100 permit tcp any host 8.7.109.70 eq 1164 access-list 100 permit tcp any host 8.7.109.70 eq 1165 access-list 100 permit icmp any host 8.7.109.70 access-list 100 permit tcp any host 8.7.109.133 eq www access-list 100 permit tcp any host 8.7.109.133 eq 443 access-list 100 permit icmp any host 8.7.109.133 access-list 100 permit tcp any host 8.7.109.71 eq www access-list 100 permit icmp any host 8.7.109.71 access-list 100 permit tcp any host 8.7.109.140 eq www access-list 100 permit icmp any host 8.7.109.140 access-list 100 permit tcp any host 8.7.109.142 eq www access-list 100 permit tcp any host 8.7.109.142 eq 443 access-list 100 permit icmp any host 8.7.109.142 access-list 100 permit tcp any host 8.7.109.141 eq www access-list 100 permit icmp any host 8.7.109.141 access-list 100 permit tcp any host 8.7.109.72 eq 443 access-list 100 permit icmp any host 8.7.109.72 access-list 100 permit tcp any host 8.7.109.31 eq 443 access-list 100 permit icmp any host 8.7.109.31 access-list 100 permit tcp any host 8.7.109.82 eq www access-list 100 permit icmp any host 8.7.109.82 access-list 100 permit tcp any host 8.7.109.134 eq www access-list 100 permit icmp any host 8.7.109.134 access-list 100 permit tcp any host 8.7.109.83 eq www access-list 100 permit icmp any host 8.7.109.83 access-list 100 permit tcp any host 8.7.109.135 eq www access-list 100 permit icmp any host 8.7.109.135 access-list 100 permit tcp any host 8.7.109.84 eq www access-list 100 permit icmp any host 8.7.109.84 access-list 100 permit tcp any host 8.7.109.136 eq 443 access-list 100 permit tcp any host 8.7.109.136 eq www access-list 100 permit icmp any host 8.7.109.136 access-list 100 permit tcp any host 8.7.109.26 eq www access-list 100 permit tcp any host 8.7.109.26 eq 443 access-list 100 permit icmp any host 8.7.109.26 access-list 100 permit tcp any host 8.7.109.167 eq www access-list 100 permit tcp any host 8.7.109.167 eq 443 access-list 100 permit icmp any host 8.7.109.167 access-list 100 permit tcp any host 8.7.109.184 eq www access-list 100 permit icmp any host 8.7.109.184 access-list 100 permit tcp any host 8.7.109.188 eq www access-list 100 permit icmp any host 8.7.109.188 access-list 100 permit tcp any host 8.7.109.189 eq www access-list 100 permit tcp any host 8.7.109.189 eq 443 access-list 100 permit icmp any host 8.7.109.189 access-list 100 permit tcp any host 8.7.109.185 eq 443 access-list 100 permit esp any host 8.7.108.68 access-list 100 permit ahp any host 8.7.108.68 access-list 100 permit icmp any host 8.7.108.68 access-list 100 permit udp any host 8.7.108.68 eq isakmp access-list 100 permit gre host 8.7.110.1 host 8.7.108.98 access-list 100 permit gre host 8.7.108.98 host 8.7.110.1 access-list 100 permit gre host 8.7.110.1 host 144.223.249.94 access-list 100 permit gre host 144.223.249.94 host 8.7.110.1 access-list 100 permit ip host 144.223.246.46 host 144.223.246.45 access-list 100 permit ip host 144.223.246.45 host 144.223.246.46 access-list 100 permit ip host 65.173.2.226 host 65.173.2.225 access-list 100 permit ip host 65.173.2.225 host 65.173.2.226 access-list 100 permit ip host 144.223.249.94 host 144.223.249.93 access-list 100 permit ip host 144.223.249.93 host 144.223.249.94 access-list 100 permit ip host 4.79.40.157 host 4.79.40.158 access-list 100 permit ip host 4.79.40.158 host 4.79.40.157 access-list 100 permit ip host 206.223.117.60 host 206.223.117.126 access-list 100 permit ip host 206.223.117.126 host 206.223.117.60 access-list 100 permit ip host 206.223.117.60 host 206.223.117.116 access-list 100 permit ip host 206.223.117.116 host 206.223.117.60 access-list 100 permit ip host 206.51.39.254 host 206.51.39.53 access-list 100 permit ip host 206.51.38.254 host 206.51.38.53 access-list 100 permit tcp 144.223.249.92 0.0.0.3 144.223.249.92 0.0.0.3 eq bgp access-list 100 permit icmp 144.223.249.92 0.0.0.3 144.223.249.92 0.0.0.3 access-list 100 permit tcp 206.223.116.0 0.0.0.255 host 206.223.116.113 eq bgp access-list 100 permit tcp host 206.223.116.113 206.223.116.0 0.0.0.255 eq bgp access-list 100 permit icmp 206.223.116.0 0.0.0.255 host 206.223.116.113 access-list 100 permit tcp 198.32.176.0 0.0.0.255 host 198.32.176.204 eq bgp access-list 100 permit tcp host 198.32.176.204 198.32.176.0 0.0.0.255 eq bgp access-list 100 permit icmp 198.32.176.0 0.0.0.255 host 198.32.176.204 access-list 100 permit tcp 206.223.115.0 0.0.0.255 host 206.223.115.11 eq bgp access-list 100 permit tcp 206.126.236.0 0.0.3.255 host 206.126.236.11 eq bgp access-list 100 permit icmp 206.223.115.0 0.0.0.255 host 206.223.115.11 access-list 100 permit icmp 206.126.236.0 0.0.3.255 host 206.126.236.11 access-list 100 permit ip host 4.71.112.65 host 4.71.112.66 access-list 100 permit tcp host 4.31.72.185 host 4.31.72.186 eq bgp access-list 100 permit icmp host 4.31.72.185 host 4.31.72.186 echo access-list 100 permit icmp host 4.31.72.185 host 4.31.72.186 echo-reply access-list 100 permit ip host 206.51.37.254 host 206.51.37.96 access-list 100 permit ip host 206.51.36.254 host 206.51.36.96 access-list 100 permit ip host 63.80.145.231 host 137.39.2.25 access-list 100 permit ip host 137.39.2.25 host 63.80.145.231 access-list 100 permit icmp host 137.39.2.25 host 63.80.145.231 access-list 100 permit icmp host 63.80.145.231 host 137.39.2.25 access-list 100 permit tcp 206.197.187.0 0.0.0.255 host 206.197.187.7 eq bgp access-list 100 permit tcp host 206.197.187.7 206.197.187.0 0.0.0.255 eq bgp access-list 100 permit icmp 206.197.187.0 0.0.0.255 host 206.197.187.7 access-list 100 permit tcp any host 8.7.111.125 eq 443 access-list 100 permit icmp any host 8.7.111.125 access-list 100 permit tcp any host 8.7.111.91 eq 443 access-list 100 permit icmp any host 8.7.111.91 access-list 100 permit tcp host 125.19.31.142 host 8.7.111.92 eq 443 access-list 100 permit icmp host 125.19.31.142 host 8.7.111.92 access-list 100 permit tcp any host 8.7.111.56 eq 443 access-list 100 permit icmp any host 8.7.111.56 access-list 100 permit tcp any host 8.7.111.61 eq smtp access-list 100 permit icmp any host 8.7.111.61 access-list 100 permit tcp any host 8.7.111.50 eq smtp access-list 100 permit icmp any host 8.7.111.50 access-list 100 permit tcp any host 8.7.111.60 eq smtp access-list 100 permit icmp any host 8.7.111.60 access-list 100 permit tcp any host 8.7.111.52 eq smtp access-list 100 permit tcp any host 8.7.111.52 eq 8100 access-list 100 permit tcp any host 8.7.111.52 eq 143 access-list 100 permit icmp any host 8.7.111.52 access-list 100 permit tcp any host 8.7.111.51 eq 443 access-list 100 permit icmp any host 8.7.111.51 access-list 100 permit tcp any host 8.7.111.53 eq 443 access-list 100 permit icmp any host 8.7.111.53 access-list 100 permit tcp host 68.165.105.15 host 8.7.111.249 eq pop3 access-list 100 permit tcp any host 8.7.111.30 eq 443 access-list 100 permit esp any host 8.7.111.30 access-list 100 permit ahp any host 8.7.111.30 access-list 100 permit icmp any host 8.7.111.30 access-list 100 permit udp any host 8.7.111.30 eq isakmp access-list 100 permit tcp any host 8.7.111.30 eq 10000 access-list 100 permit esp any host 8.7.111.29 access-list 100 permit ahp any host 8.7.111.29 access-list 100 permit icmp any host 8.7.111.29 access-list 100 permit udp any host 8.7.111.29 eq isakmp access-list 100 permit tcp any host 8.7.111.29 eq 10000 access-list 100 permit ip any host 8.7.111.21 access-list 100 permit ip any host 8.7.111.70 access-list 100 permit tcp any host 8.7.111.49 eq 22 access-list 100 permit tcp host 216.131.127.209 host 8.7.111.49 eq 443 access-list 100 permit tcp any host 8.7.111.53 eq 444 access-list 100 permit tcp any host 8.7.111.55 eq 443 access-list 100 permit tcp any host 8.7.111.54 eq 443 access-list 100 permit tcp any host 8.7.111.54 eq 446 access-list 100 permit tcp any host 8.7.111.109 eq www access-list 100 permit tcp any host 8.7.111.109 eq 1182 access-list 100 permit tcp any host 8.7.111.109 eq 1183 access-list 100 permit tcp any host 8.7.111.109 eq 443 access-list 100 permit icmp any host 8.7.111.109 access-list 100 permit tcp any host 8.7.111.71 eq 3061 access-list 100 permit tcp any host 8.7.111.253 eq www access-list 100 permit icmp any host 8.7.111.253 access-list 100 permit ip any host 8.7.111.118 access-list 100 permit ip any host 8.7.111.119 access-list 100 permit ip any host 8.7.111.120 access-list 100 permit tcp any host 8.7.111.120 eq www access-list 100 permit tcp any host 8.7.111.120 eq 443 access-list 100 permit tcp any host 8.7.111.120 eq 5901 access-list 100 permit icmp any host 8.7.111.120 access-list 100 permit tcp any host 8.7.111.122 eq 443 access-list 100 permit tcp any host 8.7.111.122 eq 444 access-list 100 permit tcp any host 8.7.111.122 eq 446 access-list 100 permit icmp any host 8.7.111.122 access-list 100 permit tcp any host 8.7.111.121 eq www access-list 100 permit tcp any host 8.7.111.121 eq 443 access-list 100 permit icmp any host 8.7.111.121 access-list 100 permit tcp host 8.7.108.94 host 8.7.108.97 eq bgp access-list 100 permit tcp host 8.7.108.94 host 8.7.108.98 eq bgp access-list 100 permit icmp any host 8.7.108.97 access-list 100 permit icmp any host 8.7.108.98 access-list 100 permit icmp any host 8.7.108.123 access-list 100 permit icmp any host 8.7.108.124 access-list 100 permit icmp any host 8.7.108.125 access-list 100 permit tcp any host 8.7.111.101 eq 5061 access-list 100 permit tcp any host 8.7.111.101 eq 443 access-list 100 permit tcp any host 8.7.111.101 eq 5269 access-list 100 permit tcp any host 8.7.111.102 eq 443 access-list 100 permit tcp any host 8.7.111.103 eq 443 access-list 100 permit udp any host 8.7.111.103 eq 3478 access-list 100 permit tcp any host 8.7.111.104 eq 443 access-list 100 permit tcp any host 8.7.111.105 eq 105 access-list 100 permit tcp any host 8.7.111.105 eq 443 access-list 100 permit icmp any host 8.7.108.126 access-list 100 permit icmp any host 8.7.108.129 access-list 100 permit tcp 125.19.41.0 0.0.0.240 host 8.7.111.16 eq www access-list 100 permit tcp 69.63.0.0 0.0.240.255 host 8.7.111.16 eq www access-list 100 permit tcp 204.15.20.0 0.0.3.255 host 8.7.111.16 eq www access-list 100 permit tcp any host 8.7.111.68 eq 22 access-list 100 permit tcp 80.67.69.0 0.0.0.255 host 8.7.111.68 range ftp-data ftp access-list 100 permit tcp 80.67.82.0 0.0.0.255 host 8.7.111.68 range ftp-data ftp access-list 100 permit tcp 72.246.199.0 0.0.0.255 host 8.7.111.68 range ftp-data ftp access-list 100 permit tcp 72.246.4.0 0.0.3.255 host 8.7.111.68 range ftp-data ftp access-list 100 permit tcp host 80.67.64.20 host 8.7.111.68 range ftp-data ftp access-list 100 permit tcp host 72.246.199.231 host 8.7.111.68 range ftp-data ftp access-list 100 permit tcp 72.247.245.0 0.0.0.255 host 8.7.111.68 range ftp-data ftp access-list 100 permit tcp 96.17.65.0 0.0.0.255 host 8.7.111.68 range ftp-data ftp access-list 100 permit tcp 96.17.66.0 0.0.0.255 host 8.7.111.68 range ftp-data ftp access-list 100 permit tcp 96.17.12.0 0.0.0.255 host 8.7.111.68 range ftp-data ftp access-list 100 permit gre host 8.7.108.95 host 144.223.246.46 access-list 100 permit tcp 96.17.67.0 0.0.0.255 host 8.7.111.68 range ftp-data ftp access-list 100 permit tcp any host 8.7.111.68 range ftp-data ftp access-list 100 permit icmp host 199.171.54.34 host 157.130.193.226 access-list 100 permit icmp host 199.171.54.42 host 157.130.193.226 access-list 100 permit icmp host 153.39.16.40 host 157.130.193.226 access-list 100 permit icmp host 153.39.16.42 host 157.130.193.226 access-list 100 permit icmp host 147.225.26.91 host 157.130.193.226 access-list 100 permit icmp host 147.225.26.93 host 157.130.193.226 access-list 100 permit icmp host 153.39.50.6 host 63.65.129.138 access-list 100 permit icmp host 199.171.54.34 host 63.65.129.138 access-list 100 permit icmp host 199.171.54.42 host 63.65.129.138 access-list 100 permit icmp host 153.39.16.40 host 63.65.129.138 access-list 100 permit icmp host 153.39.16.42 host 63.65.129.138 access-list 100 permit icmp host 147.225.26.91 host 63.65.129.138 access-list 100 permit icmp host 147.225.26.93 host 63.65.129.138 access-list 100 permit icmp host 153.39.50.6 host 63.65.129.142 access-list 100 permit icmp host 199.171.54.34 host 63.65.129.142 access-list 100 permit icmp host 199.171.54.42 host 63.65.129.142 access-list 100 permit icmp host 153.39.16.40 host 63.65.129.142 access-list 100 permit icmp host 153.39.16.42 host 63.65.129.142 access-list 100 permit icmp host 147.225.26.91 host 63.65.129.142 access-list 100 permit icmp host 147.225.26.93 host 63.65.129.142 access-list 100 permit icmp host 153.39.50.6 host 63.80.145.231 access-list 100 permit icmp host 199.171.54.34 host 63.80.145.231 access-list 100 permit icmp host 199.171.54.42 host 63.80.145.231 access-list 100 permit icmp host 153.39.16.40 host 63.80.145.231 access-list 100 permit icmp host 153.39.16.42 host 63.80.145.231 access-list 100 permit icmp host 147.225.26.91 host 63.80.145.231 access-list 100 permit icmp host 147.225.26.93 host 63.80.145.231 access-list 100 deny icmp any any echo access-list 100 deny icmp any any traceroute log access-list 100 permit icmp any any access-list 100 permit tcp any any established access-list 100 permit tcp any any gt 1023 established access-list 100 permit udp any any gt 1023 access-list 100 permit tcp any host 8.7.108.92 eq 123 access-list 100 permit udp any host 8.7.108.92 eq ntp access-list 100 permit tcp any host 8.7.108.93 eq 123 access-list 100 permit udp any host 8.7.108.93 eq ntp access-list 100 permit tcp any host 8.7.108.94 eq 22 access-list 100 permit gre host 144.228.44.94 host 8.7.110.1 access-list 100 permit ip 8.7.108.0 0.0.3.255 any access-list 100 deny tcp any any eq 445 access-list 100 deny tcp any any eq 137 access-list 100 deny ip any any 

Here is a question, would any to 8.7.109.176 port 443 match any of the ACEs?

With dt_aclcheck.tcl, it is easy:

IOU1#tclsh unix:dt_aclcheck.tcl 100 tcp any 8.7.109.176 1234 443
01
    950 permit tcp any host 8.7.109.176 eq 443
    4040 permit tcp any any established


How about icmp?

IOU1#tclsh unix:dt_aclcheck.tcl 100 icmp any any
01
    4010 deny icmp any any echo
    4020 deny icmp any any traceroute log
    4030 permit icmp any any
    4160 deny ip any any

Here is the syntax for the command:

IOU1#tclsh unix:dt_aclcheck.tcl                
Usage - dt_aclMatch.tcl <acl_name> <protocol> <source IP> <destination IP> [source port] [destination port]

Grab the file HERE, and upload it to the router. Enjoy!

And let me know if you need any help with this.

Embedded packet capture and interface ACLs and Zone Based Firewall

Cisco IOS Embedded packet capture is a great tool for trouble shooting. Very similar to the ASA capture command.

It could be better, as it won't parse the packets as good as tpcdump, but it is way better than nothing.

However I couldn't figure out what the order of operation, with regards to ACLs and ZBF.

So I labbed it up, with IOU 15.4, and here are the results:

• For incoming ACL, packets are captured before ACL is evaluated
• For incoming ZBF policy, packets are captured before the policy is checked.

So it looks like the embedded packet capture is placed at the right place, right before incoming ACL/ZBF check. However more testing needed to be done: NAT, outgoing ACL/ZBF, IPS drops,  encryption, sanity checks

I wish Cisco would have published an official and full "order of operation". Here is the best I have found so far.

FYI....

FirePower management interface

While installing Cisco FirePOWER on 5545-X, I was following the "Install and Configure a FirePOWER Services Module on an ASA Platform" guide.

One of the steps was to configure an IP address to the FirePower management interface. However, nowhere in the document it was mentioned how would that interface connect to the outside world.

So I tired to google it, and it looks like no one was asking that question: How would an internal module connect to the outside world? Not a single blog post about it. It just worked for everyone, no questions asked!

After digging around I found this document: "Cisco ASA FirePOWER Module Quick Start Guide"

And there I have found my answers:

1. For 5585-X, FirePOWER is installed on a dedicated slot with its own mgmt0 interface.
2. For 5545-X, FirePOWER module (SRF) is using the 5545-X's management0/0 interface. Which means that we can not use that interface for managment and it must be dedicated to FirePOWER!
3. For the rest, it will use the "inside" interface.

 I would have expected a command to allow me to set up a bridge between the SRF management interface and some ifname on the ASA. But no, it is hard wired! Why?

ACS 5.X REST API

For a typical network engineer, reading Cisco's REST API documentation looks really simple. All you need to do is to issue the following CLI command

acs config-web-interface rest enable.

But now what? Where are the examples? Thats easy, all you need to do is to download example code directly from the ACS administration UI. But that code is in Java, and several pages long for each example.

So let me do you a favor and show you how to extract a list of all ACS users without even writing a single line of code:

wget -O user-list.xml --auth-no-challenge --http-user=acs_admin_user --http-password=admin_pass --no-check-certificate https://acs.ip.address.x/Rest/Identity/User 

Few things to notice:

• Its a one line command UNIX command. A windows version can be found here.
• The output is XML file called user-list.xml
• --no-check-certificate is needed because ACS has its own self generated SSL certificate, and wget will fail to authenticate that certificate. This can be changed, but how many are actually using anything else?
• --auth-no-challenge is used because ACS expects to use preemptive authentication.
  

Enjoy!

CCIE Lab or dual CCIE written preferred

I got this sent from a friend of mine who is looking for a job. The job description asked for "CCIE Lab or dual CCIE written".

I wonder who wrote this stuff?

CCIE written is easy. It is not a certification exam.

The exam is not intendant to mean anything other than a ticket for the lab or to recert and existing CCIE certification, so Cisco is not putting too much effort into it. For example there are no simulations, everything is a multi-choice, so it is easy to eliminate absurd answers.

Most if not all CCIE candidates, who are already CCNPs, are surprised how easy it is. Many are fooled to believe that the lab is anywhere close to being at the same level of difficulty and depth.

If I was a CCNP, I would have preferred to take CCIE written to recert over the CCNP exams.

If I was hiring, I would prefer a dual CCNP over dual CCIE written anytime. In fact, I would prefer a humble CCNP than someone who passed the written and brags about it.

VIRL - A slow greatness

I had a migration project from 6500 to ASRs. I have decided to check out VIRL.

My migration setup requires 14 routers and a test server. Reading the system requirements for such a setup made me decide not to install on my laptop.

I went ahead and installed it on a not so small ESX server: A new UCS machine (24 cores, 380G memory, running 4 VMs, including VIRL), ESX 5.1.

I have allocated VIRL 4vCPU, 16GB memory.

The installation was not that short, but not that hard either. After the installation was over, I installed VM Maestro and started building my lab. Working with VM Maestro, which is VIRL's GUI, was really easy. The only annoying thing was my inability to set the interface numbers for the connections between routers.

Here is how my final setup looks like:

The setup is running 12 vIOS, 2 CSR1K, and one Ubuntu server, from where I ran my automated tests.

I pressed on "Start simulation" and then when trouble started. It took about 40 minutes for all the routers to load. Then the CLI felt like 2400 baud. It was crawling!

Notice that each time you start the simulation, for example after adding or removing a link, all the routers are rebuild from scratch. They are not just powered on. They are cloned from a template and go through lengthy installation process. Especially the ASRs which take forever to install themselves.

So I tried to run just 4 routers. That was working well and everything was snappy.

Then I tried to upgrade the VM to 6 vCPUs. Now it took just 3 minutes to load all the routers. The CLI felt much better at 9600 baud.

Then I tried to upgrade the VM to 8 vCPUs. Now everything works almost as fast as GNS3 with IOU!

After setting up the lab foundation, it was time actually to start configuring the lab. I have configured OSPF and BGP. Everything worked, but the response time was slower. Although the response time was slower, the lab was very usable.

To run the test, I am using some VRF magic and bash scripting on the Linux machine. I think it worth a blog entry on its own. Then after 30 minute of stepping away from the lab, I noticed that most OSPF and BGP sessions were lost. I had to press "enter" several times on each router's prompt to wake everything up:

Just when I wake the routers:

16:54:20 +++++-+---+-+---+--++++--++--+-+++++++++
16:54:33 +++++++++++++++++++++++--+++++++++++++++
16:54:36 +++++++++++++++++++++++--+++++++++++++++
16:54:40 ++++++++++++++++++++++++++++++++++++++++
16:54:42 ++++++++++++++++++++++++++++++++++++++++
16:54:43 ++++++++++++++++++++++++++++++++++++++++
16:54:45 ++++++++++++++++++++++++++++++++++++++++

After 30 minutes:

17:21:53 ++++++++++++++++++++++++++++++++++++++++
17:21:55 ++++++++++++++++++++++++++++++++++++++++
17:21:56 ++++++++++++++++++++++++++++++++++++++++
17:21:58 ++++++++++++++++++++++++++++++++++++++++
17:22:00 ++++++++++++++++++++++++++++++++++++++++
17:22:01 ++++++++++++++--+------++++--+--+-++++++
time     111112222222333333444445555666677788899B
%H:%M:%S 589BC34679BC4679BC679BC89BC79BC9BC9BCBCC
17:22:17 +++++-----+-----+------++++--+--+-++++++
17:22:40 +++++-----+-----+------++++--+--+-++++++
17:23:02 +++++-----+-----+------++++--+--+-++++++
17:23:24 +++++-----+-----+------++++--+--+-++++++

In the beginning, I was very annoyed by this, but then I realized that it is just another test case "everything is broken. Can my network recover?".

To sum up my experience:

 

VIRL is a splendid product. Very polished for early release. It takes too much resources to get the job done. I prefer GNS3 with IOU as I can run in on my laptop. No need for a monster server.

GNS3 1.1

I was never a big fan of GUI tools, so I used dynagen and dynamips for my network designs. But since 15.2 was the last version released for 7200, dynamips is no longer useful (especially for IKEv2 and OSPFv3 stuff)

I was hoping that Cisco would release VIRL, and they promised to do so for the past year and a half, but it looks like it will never come. Shelling out 10K$ for CML (the payed version of VIRL) is a bit too much for most of us. But there is a good alternative:

Not long time ago GNS3 version 1.0 was released and soon after version 1.1. was released too. And after long time of being a backer for their funding campaign I have decided to try GNS3 with IOU.

After installing GNS3 on both linux and windows (vmware required), I found that GNS3 is really easy to use, and that IOU is AMAZING. IOU is sooooo fast, and everything just works(tm). I wish I had it years ago!

Goodbye dynamips and dynagen, and thank you so much.

Hello IOU and GNS3. I know it will be a start of a wonderful friendship :)