What is the implicit deny, and how do you see what it is dropping?
Show the answer
Say this first
Every ACL ends with an invisible line that denies everything: deny ip any any in an extended ACL,
deny any in a standard one. A packet that matches no line is dropped. That line has no hit counter,
so to see what it drops I add an explicit deny ip any any log as the last line. It matches the same
traffic, but now I get a counter and syslog messages.
Go deeper
Consequences people forget
- An ACL with only deny lines blocks everything. It needs permits, often a final
permit ip any any. - An inbound ACL on a routed interface also sees control traffic aimed at the router: OSPF (IP protocol 89), BGP (TCP 179), HSRP, DHCP. Forget to permit them and the adjacency drops when the dead timer expires.
- On IOS, applying an ACL name that does not exist yet filters nothing. Deleting an ACL that is still applied also leaves the interface permitting everything.
- Outbound ACLs do not filter packets the router itself originates.
Seeing the drops
ip access-list extended WAN-IN
10 permit ospf host 10.0.12.2 any
20 permit tcp 10.1.0.0 0.0.255.255 10.2.50.0 0.0.0.255 eq 443
999 deny ip any any logR2# show ip access-lists WAN-IN
Extended IP access list WAN-IN
10 permit ospf host 10.0.12.2 any (1204 matches)
20 permit tcp 10.1.0.0 0.0.255.255 10.2.50.0 0.0.0.255 eq 443 (88512 matches)
999 deny ip any any log (57 matches)
%SEC-6-IPACCESSLOGP: list WAN-IN denied tcp 10.1.20.30(50522) -> 10.2.50.10(22), 1 packetIOS logs the first match right away and then summarizes repeat matches periodically (every five
minutes by default). Logged packets are handled by the CPU, so log on a line with heavy traffic
costs CPU. log-input also records the input interface and source MAC.
They will ask next
Does the implicit deny catch traffic the router sends?
No. Outbound ACLs never see locally generated packets. Inbound ACLs do see traffic aimed at the router, which is why they can break routing protocols and SSH to the box.
Is it the same for IPv6 ACLs?
Almost. IPv6 ACLs on IOS have implicit permits for Neighbor Discovery NS and NA before the implicit
deny ipv6 any any. If you add your owndeny ipv6 any any log, those implicit permits are never reached and neighbors stop resolving, so add the ND permits back above it.
Traps
- Putting the explicit
deny ip any any loganywhere but last. Every line below it becomes dead. - Leaving
logon a high-volume permit line and then wondering why the CPU climbs.