A structured lesson workspace with readable content, hands-on examples, and a clean path to completion.
A scheduled change added a new ACL rule to block an unwanted source. The change worked for that specific source, but overnight a dozen legitimate users reported they couldn't access the database. The rule was inserted at the top of an existing ACL — with the wrong wildcard mask — and it was now matching the wrong traffic. The change passed review because nobody looked at hit counters before and after.
ACL problems almost always trace to one of four causes: wrong placement, wrong direction, wrong syntax, or ordering. All four are visible in the `show` output if you know what to look for. This lesson is about reading that output correctly.
Rules with matches are active. Rule 15 — the Redis rule — has zero matches. Either nothing uses Redis (rule not needed), or the port is wrong, or the source is different than expected. Rule 30 — the deny — has 47 matches, meaning 47 packets were dropped. If those weren't supposed to be dropped, something in the policy is too tight.
| Symptom | Likely cause | Check |
|---|---|---|
| ACL configured but no traffic filtered | Applied to wrong interface or direction | `show ip interface <intf>` |
| Legitimate traffic blocked | Implicit deny — some permit missing | Look at the deny counter |
| Wrong traffic blocked | Wildcard mask typo, wrong source/dest | Read the ACL line by line |
| Rule never matches (0 hits) | Rule unreachable — earlier rule matches it first | Look at ordering and counter values |
| Both permit and deny counters incrementing | ACL matches per-packet — check for asymmetric traffic | Look for return path |
! Enable ACL match loggingR1(config)# access-list 100 permit tcp 10.10.20.0 0.0.0.255 host 10.10.99.10 eq 443 log! Watch log messages liveR1# terminal monitor! Or filter the logR1# show logging | include LIST
The `log` keyword on an ACL rule causes the router to log matching packets. Combined with `terminal monitor`, this gives you live visibility into which traffic the ACL is seeing. Use it sparingly in production — logging every matched packet on a high-traffic ACL generates enormous log volume.
ACLs are deceptively simple to configure and deceptively hard to get right. The verification workflow is always the same: check interface, check direction, check counters, look for 0-hit rules and unexpected deny counts. Learn to read `show access-lists` and you'll solve ACL problems in minutes.
Finish the lesson once you have worked through the material. This awards ★ 30 XP.