Switches, Hubs, and Modems
cancel
Showing results for 
Search instead for 
Did you mean: 

Unable to apply access control list. failed to add entry

mortalwombat
Advisor

Unable to apply access control list. failed to add entry

I am trying to apply ACLs to the ports on my 2910, but am running into a problem.

For some reason, it will only allow me to apply an ACL to specific ports, and I can't figure out why. In my case, ports 13-24 are part of VLAN 101. I am trying to apply an extended ACL to it. I can apply it to ports 13-16, but not ports 17+

MC_Core_Switch(config)# ip access extended 101
MC_Core_Switch(config-ext-nacl)# 10 permit ip 172.20.101.0/24 172.20.101.0/24
MC_Core_Switch(config-ext-nacl)# exit
MC_Core_Switch(config)# int 13
MC_Core_Switch(eth-13)# ip access 101 in
MC_Core_Switch(eth-13)# int 14
MC_Core_Switch(eth-14)# ip access 101 in
MC_Core_Switch(eth-14)# int 15
MC_Core_Switch(eth-15)# ip access 101 in
MC_Core_Switch(eth-15)# int 16
MC_Core_Switch(eth-16)# ip access 101 in
MC_Core_Switch(eth-16)# int 17
MC_Core_Switch(eth-17)# ip access 101 in
Unable to apply access control list. failed to add entry 10.
2 REPLIES
mortalwombat
Advisor

Re: Unable to apply access control list. failed to add entry

Here is my running config:

Running configuration:

; J9147A Configuration Editor; Created on release #W.14.03

hostname "MC_Core_Switch"
time timezone -8
ip access-list extended "100"
1 remark "Creative Services VLAN"
10 remark "Allow hosts to ping within VLAN"
10 permit ip 172.20.100.0 0.0.0.255 172.20.100.0 0.0.0.255
20 remark "Allow Creative Services FS to fwd to SD Ingest"
20 permit ip 172.20.100.22 0.0.0.0 172.20.102.23 0.0.0.0
21 remark "Permit Creative Services FS to fwd to Segmenter01"
21 permit ip 172.20.100.22 0.0.0.0 172.20.102.31 0.0.0.0
22 remark "Permit Creative Services FS to fwd to Segmenter02"
22 permit ip 172.20.100.22 0.0.0.0 172.20.102.32 0.0.0.0
exit
ip access-list extended "101"
10 permit ip 172.20.101.0 0.0.0.255 172.20.101.0 0.0.0.255
exit
ip access-list extended "102"
10 remark "Allow hosts to ping within VLAN"
10 permit ip 172.20.102.0 0.0.0.255 172.20.102.0 0.0.0.255
20 remark "Allow SD Ingest to fwd to Creative Services FS"
20 permit ip 172.20.102.23 0.0.0.0 172.20.100.22 0.0.0.0
30 remark "Allow Segmenter01 to fwd to Creative Services FS"
30 permit ip 172.20.102.31 0.0.0.0 172.20.100.22 0.0.0.0
31 remark "Allow Segmenter02 to fwd to Creative Services FS"
31 permit ip 172.20.102.32 0.0.0.0 172.20.100.22 0.0.0.0
40 remark "Permit SD Ingest to fwd to Pathfire VLAN"
40 permit ip 172.20.102.23 0.0.0.0 172.20.101.0 0.0.0.255
exit
ip access-list extended "103"
10 remark "Allow hosts to ping within VLAN"
10 permit ip 172.20.103.0 0.0.0.255 172.20.103.0 0.0.0.255
exit
ip access-list extended "104"
10 remark "Allow hosts to ping within VLAN"
10 permit ip 172.20.104.0 0.0.0.255 172.20.104.0 0.0.0.255
exit
ip access-list extended "105"
10 remark "Allow hosts to ping within VLAN"
10 permit ip 172.20.105.0 0.0.0.255 172.20.105.0 0.0.0.255
exit
ip access-list extended "106"
10 remark "Allow hosts to ping within VLAN"
10 permit ip 172.20.105.0 0.0.0.255 172.20.105.0 0.0.0.255
exit
module 1 type J9147A
interface 13
ip access-group "101" in
exit
interface 14
ip access-group "101" in
exit
interface 15
ip access-group "101" in
exit
interface 16
ip access-group "101" in
exit
ip routing
vlan 1
name "DEFAULT_VLAN"
untagged 1-6
ip address 172.20.1.1 255.255.255.0
tagged 7-48
exit
mortalwombat
Advisor

Re: Unable to apply access control list. failed to add entry

I solved this. Turns out upgrading to the newest version software solved the issue.