FQDN in ip access-list?

bob_heathote — Thu, 16 Apr 2020 22:52:03 GMT

Hi, Seems I have found a bug in 8.0.7d where if I use an extended acl with a fully qualified domain name the switch will reboot. I looked at the command reference for this version and it does not say whether or not you can, but when I look at the same doc for 8.0.92 they give an example for a standard ACL, i.e., "IPHost1" as shown below.

device# configure terminal
device(config)# ip access-list standard 1
device(config-std-nacl)# deny host 10.157.22.26 log
device(config-std-nacl)# deny 10.157.29.12 log
device(config-std-nacl)# deny host IPHost1 log

As the device is in production I'm wondering if it is safe to use a standard ACL on 8.0.7d or do I need to upgrade, and if so, what is the next version which support ip access-list with FQDN.

Thanks!

Re: FQDN in ip access-list?

simon_pollard — Fri, 17 Apr 2020 08:40:01 GMT

Hi Bob

The difference between the documents reflects a correction that was made in the 8.0.80 guide when the commands syntax was updated.

If you have a support contract I would recommend opening a case so that TAC can investigate the issue and recommend the best course of action.

If you don't have a support contract you should consider upgrading to 8.0.90f, ideally test the configuration on a switch before putting it into production if at all possible.

Note that the upgrade to 8.0.90 is a two step process, you should upgrade to 8.0.80e first and then to .90f. Refer to the 8.0.90 upgrade guide for more details.

topic Re: FQDN in ip access-list? in ICX Switches

FQDN in ip access-list?

Re: FQDN in ip access-list?