Problem with ACLs hit counts

Hello
I've applied the following ACL to an interface but don't see the hit counts (e.g. something like
30 deny tcp any any (58 hw matches)):
RP/0/RSP0/CPU0:test#show access-lists ipv4 2020
Fri Aug 26 09:34:48.094 HKT
ipv4 access-list 2020
10 deny ipv4 any host 202.146.219.55
20 deny ipv4 any host 218.213.235.211
30 deny ipv4 any host 116.193.159.79
50 deny ipv4 any host 111.68.2.101
60 deny ipv4 any host 112.121.170.43
77 deny ipv4 host 117.211.87.202 any
78 deny ipv4 host 202.29.220.238 any
79 deny udp any host 218.213.92.3
80 deny udp any host 218.213.91.45
81 deny ipv4 host 59.42.249.51 host 218.213.91.45
Also got the following:
RP/0/RSP0/CPU0:test#show access-lists ipv4 2020 hardware ingress interface gigabitEthernet 0/0/0/31 sequence 81 location 0/0/CPU0
Fri Aug 26 09:34:52.209 HKT
The interface does not have per-interface statistics enabled
RP/0/RSP0/CPU0:test(config-if)#ipv4 access-group 2020 ingress interface-statisticsRP/0/RSP0/CPU0:test(config-if)#commitMon Aug 29 09:44:42.725 HKT
% Failed to commit one or more configuration items during a pseudo-atomic operation. All changes made have been reverted. Please issue 'show configuration failed' from this session to view the errors
Is there any configuration still missing??
Pls help. Thanks!

Thanks!
Have tried but still got the following:
RP/0/RSP0/CPU0:test(config-if)#show config failed
Wed Aug 31 09:41:58.730 HKT
!! SEMANTIC ERRORS: This configuration was rejected by
!! the system due to semantic errors. The individual
!! errors with each failed configuration command can be
!! found below.
interface GigabitEthernet0/0/0/23
ipv4 access-group 2020 ingress hardware-count interface-statistics
!!% 'pfilter-ea' detected the 'warning' condition 'Mode mismatch.ACL has been applied in different modes on this LC - interface stats and ace stats. '
end
Could you let me know the reason? Thanks again.

Similar Messages

ACL Hit Counts

ACL hit counts
Hi,
I jsut needed to clarify something, i have a data Center & branch Office connected to each other through IPSec VPN. I also have SSL-VPn configured on the firewall in my data center, the same firewall on which the IPSec VPn from my branch offfice terminates.
I retrieved some ACL logs from the ASA in the data center and all the hit counts shon are zero even when the connection is established and my branch office users are able to access all resources.
e.g. access-list CRYPTO_XXXXX line 8 extended permit ip x.x.x.x 255.255.0.0 y.y.y.y 255.255.255.0 (hitcnt=0) 0x8142efc9
All the ACL are like this where y.y.y.y is the branch office subnet
I also have another ACL which poped up on my SSL VPN ACL as shown below
e.g. access-list DAP-ip-user-906E4E06 line 1 extended permit ip x.x.x.x 255.255.255.0 host y.y.y.y (hitcnt=22162) 0x440bdd04
access-list SSLVPN-CORP-ACL line 1 extended permit ip x.x.x.x 255.255.255.0 host y.y.y.y(hitcnt=0) 0xc9d27468
can anyone tell me why is my hit count is zero for both CRYPTO ACL and the SSLVPN-CORP-ACL even when the connection is established?
Second, what is DAP-ip-user-906E4E06? why is it showing such?
Thanks a lot in advance.

Hi Jennifer,
many thanks for the response.
I totally agree regarding the traffic initiation and hit count. I have totally 5 branch office and the same traffic initiation test when i try on the other branch offices, i can see the increase on their respective firewalls.
Any idea what might be wrong with the fiorst branch and why the hitcount does not increase.
The DAP policies were created 2-3 years back and i havent seen any such logs so far, i think this is the first time.
I have used RSA appliance for authenticating the users and remember enabling RADIUS on it. Will it cause of that.
regards

Strange problem with ACLs

Hi,
I have just migrated an oracle database from 11.1.0.7 on Win Server 2003 to 11.2 on Linux 64 bit. I am having a strange problem with ACLs - I can create the ACL but when I perform either of the following two commands:
SELECT * FROM DBA_NETWORK_ACLS
or
SELECT * FROM NET$_ACL
I get no rows returned. The ACL exists somehow because if I try and create it again I get the error that it exists. Has anyone got any advice here? Something is out of sync and I need to know how to fix it up.
Thanks
Adam

BEGIN
DBMS_NETWORK_ACL_ADMIN.CREATE_ACL (
acl => 'email_server_acl.xml',
description => 'Network connection Email Server',
principal => 'MAIL',
is_grant => TRUE,
privilege => 'connect');
END;
PL/SQL procedure successfully completed.
select * from DBA_NETWORK_ACLS;
(no rows)
BEGIN
DBMS_NETWORK_ACL_ADMIN.CREATE_ACL (
acl => 'email_server_acl.xml',
description => 'Network connection Email Server',
principal => 'MAIL',
is_grant => TRUE,
privilege => 'connect');
END;
ORA-31003: Parent /sys/acls/ already contains child entry email_server_acl.xml
ORA-06512: at "SYS.DBMS_NETWORK_ACL_ADMIN", line 252
ORA-06512: at line 2
Edited by: Adam J. Sawyer on 15/04/2011 17:08

ACL Hit Count Expiration

Is there a way to configure an ACL to automatically expire and delete itself after a set amount of time of not being hit. For example:
Say I configure a specific rule permiting a specific user using a static IP address to traverse Network A and hit an application on Server X located on Network B. Six months later I forget about said user and he or she moves to another department and no longer needs access with that IP address to that server. Is there a way to configure that rule to automatically drop off if the hit count remains at 0 for longer than X amount of days?
Thanks!

There is no such dynamic option of deleting an ACL of not being hit by packets for a specific source/destination for a specified period of time.
The only option you got is to use time-based ACL and set the time that you want for that source/destination traffic. Time-based ACL is as flexible as water. You can set it to use recurring time or absolute time, which is your case.
Firewall(config)# time-range Temp_Worker
Firewall(config-time-range)# absolute [start hh:mm day month year] [end hh:mm day month year]
Hope this helps.
AM

Problem with LCD hitting the back edge

My Macbook has a problem. The bezel on the LCD towards the very rear of the screen rubs against the base edge when I open up the MacBook.
Here is a picture to describe what I mean:
http://www.flickr.com/photos/47365659@N00/151797793/
That little piece is sticking out. If I open the MacBook from with more force on the right edge, then the tab hits even more and there is enough friction to make an alarming snapping sound.
I hope apple replaces my macbook as I just received it today from fedex!
Has anyone experienced this yet?
Macbook Mac OS X (10.4.6)

I have not had this problem with my Macbook.
I suggest you contact them right away.
I also suggest you don't "ask" them to replace it. I would tell them it needs to be replace. Over time I think that will make for a nasty scar on your notebook. Considering black macbook owners pay 150$ for just the color, Apple knows that how these look has much to do with their value and shoudl approach the problem knowing that.
I hope it goes well, and expect it will.
Kalel

Apex instalation problem with ACL

Hi
I had apex 4.0 and oracle 11g. My apex worked properly - I think about mailing.
Next I have made upgrade -> apex 4.2.1 and I have a problem with it. Apex doesn't send mail.
I run PL/SQl block (from documentation http://docs.oracle.com/cd/E37097_01/doc/install.42/e35123/otn_install.htm#autoId3
topic 3.3.8 and 3.3.8.1):
DECLARE
ACL_PATH VARCHAR2(4000);
BEGIN
-- Look for the ACL currently assigned to '*' and give APEX_040200
-- the "connect" privilege if APEX_040200 does not have the privilege yet.
SELECT ACL INTO ACL_PATH FROM DBA_NETWORK_ACLS
WHERE HOST = '*' AND LOWER_PORT IS NULL AND UPPER_PORT IS NULL;
IF DBMS_NETWORK_ACL_ADMIN.CHECK_PRIVILEGE(ACL_PATH, 'APEX_040200',
'connect') IS NULL THEN
DBMS_NETWORK_ACL_ADMIN.ADD_PRIVILEGE(ACL_PATH,
'APEX_040200', TRUE, 'connect');
END IF;
EXCEPTION
-- When no ACL has been assigned to '*'.
WHEN NO_DATA_FOUND THEN
DBMS_NETWORK_ACL_ADMIN.CREATE_ACL('power_users.xml',
'ACL that lets power users to connect to everywhere',
'APEX_040200', TRUE, 'connect');
DBMS_NETWORK_ACL_ADMIN.ASSIGN_ACL('power_users.xml','*');
END;
COMMIT;
It ended with errors:
Error report:
ORA-29903: błąd podczas wykonywania podprogramu ODCIIndexFetch()
ORA-22881: wiszący REF
ORA-06512: przy linia 7
29903. 00000 - "error in executing ODCIIndexFetch() routine"
*Cause:    The execution of ODCIIndexFetch routine caused an error.
*Action:   Examine the error messages produced by the indextype code and
take appropriate action.
committed.
What should I do?
Ziut

I repaired all the permissions on the user account directories and this fixed my issues with share folder permissions for some reason.
Here is a script that will do it all in one go. Change /Volumes/XXXX/Users/ to where you users directory is. chmod the script to 755 and run with sudo and it will fix the user directory permissions for all accounts.
#!/bin/sh
# This shell script needs to be run as super-user
for i in /Volumes/XXXX/Users/*
do
u=`echo $i | cut -d/ -f5`
case $u in
Shared)
Temporary)
   /usr/sbin/chown -R $u:staff $i
   /bin/chmod -R 700 $i
esac
done
for i in /Volumes/XXXX/Users/*
do
u=`echo $i | cut -d/ -f5`
case $u in
Shared)
Temporary)
   /usr/sbin/chown $u:staff $i
   /bin/chmod 755 $i
esac
done
/usr/sbin/chown -R 'root':wheel '/Users/Shared'
/bin/chmod -R 777 '/Users/Shared'
for i in /Volumes/XXXX/Users/*
do
u=`echo $i | cut -d/ -f5`
case $u in
Shared)
Temporary)
   /usr/sbin/chown -R $u:staff $i/Public
   /bin/chmod -R 755 $i/Public
esac
done
for i in /Volumes/XXXX/Users/*
do
u=`echo $i | cut -d/ -f5`
case $u in
Shared)
Temporary)
   /usr/sbin/chown -R $u:staff $i/Public/Drop\ Box
   /bin/chmod -R 733 $i/Public/Drop\ Box
esac
done
for i in /Volumes/XXXX/Users/*
do
u=`echo $i | cut -d/ -f5`
case $u in
Shared)
Temporary)
   /usr/sbin/chown -R $u:staff $i/Sites
   /bin/chmod -R 755 $i/Sites
esac
done
exit 0

Old problem with precision time counting and /usepmtimer solution.

Hello, all!
There was a problem in Windows XP and 2003 Server with using QueryPerformanceCouner() function. Sometimes it can cause problem with precision time measurements on CPUs which support powersaving modes by changing clock frequency. The simplest solution for that was /usepmtimer key in boot.ini file which forces the system to use another timer.
I just want to know does this problem appear in Windoes 7? And how to solve it since there is no boot.ini file in Windows 7?
Thanks a lot!
P.S. This is a page with detailed description of the problem:
http://support.microsoft.com/default.aspx/kb/895980

Hi ,
There is official documentation released on userpmtimer for windows 7 operating system.
Also the KB article only refere to the OS which have performance problem.
After reading the below article , i feel that this problem is taken care in windows 7 / windows 2008 ( though there is no formal written documentation )
http://blogs.technet.com/perfguru/archive/2008/02/18/explanation-for-the-usepmtimer-switch-in-the-boot-ini.aspx
you can post in windows 7 dedicated forum, so that MVP / Microsoft Engineers and community members would suggest you with latest data if any.
http://social.technet.microsoft.com/Forums/en-US/category/w7itpro

Problem with ACL in CSS-to-CSS redundancy configuration

I have two CSSes - first is master, second is backup. When I enable ACL on master CSS, it can't see more the backup CSS. My first rule is to allow all traffic between both CSSes. I have CSS 11050 with 4.10 Build 10.
Here is a part of my config:
--- begin ---------------------------------------------------
!************************* INTERFACE *************************
interface e8
bridge vlan 254
description "css1 <-> css2 (net 192.168.254.0/30)"
!************************** CIRCUIT **************************
circuit VLAN254
ip address 192.168.254.1 255.255.255.252
redundancy-protocol
!**************************** NQL ****************************
nql n_csw_to_csw
ip address 192.168.254.1 255.255.255.255
ip address 192.168.254.2 255.255.255.255
!**************************** ACL ****************************
acl 1
clause 1 bypass any nql n_csw_to_csw destination nql n_csw_to_csw
apply circuit-(VLAN254)
--- end ---------------------------------------------------
Where is the problem? Is it a bug in my current version or an error in my configuration?
Thanks
Thomas Kukol

at first step read http://www.cisco.com/warp/customer/117/css_packet_trace.html
and trace your unworking configuration
if you give flow option 0xffffff you should see why ACL didn't pass app traffic..
second idea is to use normaln acls w/o nql....
with permit keyword...
share expirience here again 8-)

Problem with apex_application.g_fxx.count

Okay, I am at my wits end on this one.
I'm running Apex 4, and on one of my screens I have a manually created tabular report. For one of the master records, this tabular report returns 12 rows, yet apex_application.g_fxx.count consistently returns 24 as the count. For other master records, this is working correctly however, returning the same number as what is showed on screen.
I've tried to duplicate it on apex.oracle.com, but it works correctly there as well.
I've checked the data table, and there are only twelve rows there, same as what the tabular report shows. I've added in TONS of code to report back what is happening and everything looks fine in the code and processing, but the data that gets saved is out out sync, since it appears that for some reason the xxx.count (for only this one master record) is somehow doubling the count, so the data that gets saved is off. For example, say someone makes a change to the third sub-record, the 'count' suddenly becomes 6, so it saves the changes for the sixth sub-record.
Has anybody else ever seen this phenomenon and knows what causes it? I've spent three fruitless days trying to track this down so far.
Thanks,
Bill Ferguson
A bit of further information.
In my app, users must list all commodities present at a site first (different screen). They may then go to my Resources screen and input the tonnage and grades of the various commodities present. This ensures that users cannot add tonnage and grade information for a commodity that is not listed as being present at the site.
So, when they get to the Resources screen, the bottom is all filled out with all of the commodities listed, and they simply have to type in the grade. The users also wnated the ones with information in the grade fields to appear at the top, so I had to add an order by to the query, as follows:
SELECT a_rec,
       c_code,
       import,
       item,
       grade,
       grade_units,
       child_key,
       count_order
FROM (SELECT rec a_rec,
               c.commod || ' - (' || code || ')' c_code,
               c.import,
               item,
               grd grade,
               grd_units grade_units,
               child_key,
               rec count_order
          FROM    RESOURCE_DETAIL rd
               RIGHT OUTER JOIN
                  commodity c
               USING (dep_id, code)
         WHERE (CHILD_KEY = 1028244420100003) -- actually using a variable here instead of hard-coded values
        UNION
        SELECT c.line a_rec,
               c.commod || ' - (' || code || ')' c_code,
               import,
               NULL item,
               NULL grade,
               NULL grade_units,
               NULL child_key,
               c.line + 200 count_order
          FROM commodity c
         WHERE dep_id = 10282444 -- actually using a variable here instead of hard-coded values
               AND code NOT IN
                      (SELECT code
                         FROM resource_detail
                        WHERE dep_id = 10282444 AND yr = 2010 AND line = 3)) -- actually using variables here instead of hard-coded values
ORDER BY import, count_orderNow, on the screen the commodities are listed as:
Copper
Gold
Molybdenum
Silver
Gemstone
Lead
Zinc
Uranium
Gypsum
REE
Talc
Garnet
But, the code I've added to see what is happening is instead saying the records being processed are in this order:
Copper
Garnet
Gemstone
Gold
Gypsum
Lead
Molybdenum
REE
Silver
Talc
Uranium
Zinc
I do not have any sort criteria specied in the Report attributes. So, why is the order of processing (for i in 1 .. apex_application.g_f03.count) processing in a different order than what is shown on screen?

Hi Arie,
This was a strange one to track down. I wound up adding all kinds of logging statements in my code, writing things out to a table while processing, counts, which record, etc., and suddenly it dawne don me that everything was being processed in alphabetical order by commodity name, even though the screen display was by two other fields. I played around with different 'order by' settings, but the processing somehow was always by the commodity name. I have no idea where it was getting that 'directive', but nothing I could figure out changed it.
So to recap, in case I didn't explain it well enough above, this is a manually created tabular form, with a 'regular' form above it (master-datail). I use the apex_item.text, etc. constructs to create the tabular form, and then in my 'proceses' I'm using the normal apex_application.g_fxx array to perform the processing. While the screen display from the tabular report shows everything with an order by of two columns, the processing always was done ordered by a diffierent, no-specified column.
Changing my report definition to use the same 'order by' as the processing seemed to be working fixed the problem, though I have no idea where it was getting the 'order by' from to overwrite what was being on screen. I'm not sure if this is a bug or not, I vaguely remember Scott Spadafore commenting about this behaviour a long, long time back, but I can't find the post. It was probably back in the 2.x days.
I also have no idea what is causing the array to somehow double for some records and not on others. In this particular case, the record I had on screen only had 7 commodities, but when I printed the result of apex_application.g_fxx.count, it always showed 14, even though on apex.oracle.com, when I tried to re-create the problem, it worked correctly and only reported 7. Most records in my database that I tested this on worked correctly, reporting the correct number of commodities, but occasionally I'd run across one where the number was doubled. I don't know if there is some internal table Apex uses that I could truncate (like possibly wwv_flow_collection_members?) where possisbly this type of information be kept. The only thing I can think of is that somewhere these counts are stored in a collection and it is populated with data from a real old incarnation, and during processing it stumbles across these old records and uses the old values. It doesn't seem like a realistic possibility, but it about the only explanation I can think of.
Bill Ferguson

Problem with getting word count in TLF text

Hi,
I want to get the word count from my TLF text, but the problem is that I am not being able to handle th case for space.
I am using the findNextWordBoundary property of ParagraphElement as shown below:
private function countWords( para : ParagraphElement ) : void
            var wordBoundary:int = 0;
            var prevBoundary:int = 0;
            while ( wordBoundary != para.findNextWordBoundary( wordBoundary ) )
               // If the value is greater than 1, then it's a word, otherwise it's a space.
                if ( para.findNextWordBoundary( wordBoundary ) - wordBoundary > 1)
                    wordCount += 1;
                prevBoundary = wordBoundary;
                wordBoundary = para.findNextWordBoundary( wordBoundary );
                // If the value is greater than 1, then it's a word, otherwise it's a space.
                if ( wordBoundary - prevBoundary > 1 )
                    var s:String = para.getText().substring( prevBoundary, wordBoundary );
                    lenTotal += s.length;
Now I have 2 issues here:
If my string is for eg: Hi, I am writing in "TLF". And I want to get its word count then
1) Suppose I take the case of the string Hi, . Then para.getText().substring( prevBoundary, wordBoundary ) gives the text as Hi i.e without the comma. Same case for the string "TLF forums" , It treats each " as a single word and not the whole "TLF" as a single word. Why doesn't it compute till spaces, that should be the ideal case. So until we don't give a space it should count the whole thing as a word.
2) So now the problem is I have applied a condition   if ( wordBoundary - prevBoundary > 1 ) to check if it is a space i.e. if the diff is <= 1 it is a Space. But if I use this I miss out on single words. Like for eg if I have "Hi, This is a string" ,then 'a' is ignored too.
Now I could have added a check here along with the space check that the string between prevBoundary and wordBoundary is " "(i.e a space), Then also it is a problem as then the single words like a,&,I will be ignored.
So, now I am stuck with this issue and need some help from you guys.
Thanks

findNextWordBoundary is not going to serve your purpose. I'd propose doing something like this:
// didn't test this but something like this - whitespace matches any set of 1 or more white space characters
static const whiteSpaceRegExp:RegExp = /[u0020|u000A|u000D]*/
public static function countWords( para : ParagraphElement ) : void
     return para.getText().split(whiteSpaceRegExp).length;
A good list of everything considered whitespace extracted from the unicode space can be found here:
http://sourceforge.net/adobe/tlf/svn/449/tree/trunk/textLayout/src/flashx/textLayout/utils /CharacterUtil.as
In function createWhiteSpaceObject
Hope that helps,
Richard

Problem with ACLs

My OS X server is really strange, im unable to propagate permissions through the GUI.
Can anyone help me out with a terminal command to apply permissions for a active directory group, read/write permissions and to all subfolders / files?

Thanks!
Have tried but still got the following:
RP/0/RSP0/CPU0:test(config-if)#show config failed
Wed Aug 31 09:41:58.730 HKT
!! SEMANTIC ERRORS: This configuration was rejected by
!! the system due to semantic errors. The individual
!! errors with each failed configuration command can be
!! found below.
interface GigabitEthernet0/0/0/23
ipv4 access-group 2020 ingress hardware-count interface-statistics
!!% 'pfilter-ea' detected the 'warning' condition 'Mode mismatch.ACL has been applied in different modes on this LC - interface stats and ace stats. '
end
Could you let me know the reason? Thanks again.

Solaris 10 10/08 jds3 problems with acls

hi we use solaris 10 10/08 with jds3 and srss 4.1 with ldap auth and when we set acl on the filesystem nautilus did not notice the acl, on the console it is all right read, write and access the folders is no problem. i use smpatch to apply the latest patches so has anybody an idea ?
sincerely
Christian Rauecker

Thanks for your reply.
I will try of course with the CDROM, It doesn't hurt ;-)
I was only hoping that someone could confirm. I suspect a trouble with the CDROM because it's not documented...
My customer doesn't have yet a Solaris server available where I could setup a boot/install server.
It means that I will have to find first a Solaris server and then setup the boot/install server to install the system (T5x40).
Regards,
JNV

A problem with ACL in the class-map on the ACE module

Hi all,
I configured the following on the ACE module:
object-group network test
host 192.168.1.21
host 192.168.1.22
host 192.168.1.23
object-group service port
tcp eq www
tcp eq 8080
access-list T line 8 extended permit object-group port object-group test any
I tried to configure a class-map for matching this ACL:
ACE-4710-2/Lab-OPT-11(config)# class-map match-any TEST_C
ACE-4710-2/Lab-OPT-11(config-cmap)# match access-list T
Error: Cannot associate acl having object-group ACEs in class-map.
So couldn't I configure the class-map by using ACL with object-groups involved? Is it the bug or the normal behaviour? Because the customer uses object-groups in ACLs and he has to configure ACL without object-groups for the traffic classification. It is horrible.
Thank you
Roman

Hi Roman,
I'm afraid it's the expected behavior. You cannot use an ACL with object-groups inside a class-map.
Regards
Daniel

Problem with Korean Word Counting

After upgrading to Yosemite 10.10.3, Korean word counting in Pages got mesed up. Before the upgrade, there was no problem. But now Pages counts every single letter I typed as a "word." As a writer who should be sensitive to the number of words I type, this is very annoying. Is there anyone who experiences the same problem? is there any fix?

See
Korean word count

SQLException: Access not allowed (problem with ACL)

Hi, I'm getting the following error when I start my Weblogic (7.0) server.
java.sql.SQLException: weblogic.common.ResourceException: Access not allowed
I followed these steps to Provide the necessary ACl permisiions:
1. Compatibility Security => ACLs
Create a new ACL:
name : weblogic.jdbc.connectionPool.yourPoolname
permission : admin
group : Administrators
2. Create a new Connection Pool:
ACL Name : weblogic.jdbc.connectionPool.yourPoolname
In 'Target' tab, choose server and click the Apply button.
I even checked fileRealm.properties, the user admin123 (the user name with which I start the server), is included in all the connectionpool ACL lists. I restarted the server to pick the new changes but it still gives the same errors.
Please help,
Thanks

You need to create the correct ACL for the DataSource following this procedure in the Administration Console:
1. Compatibility Security => ACLs
Create a new ACL:
name : weblogic.jdbc.connectionPool.yourPoolname
permission : admin
group : Administrators
2. Compatibility => click Refresh button
3. Services => JDBC => Connection Pool
Create a new Connection Pool:
ACL Name : weblogic.jdbc.connectionPool.yourPoolname
In 'Target' tab, choose server and click the Apply button.
4. Services => JDBC => Data Sources
You can create a new Data Source using this connection pool successfully
Regards,
Prasanna Yalam

Problem with ACLs hit counts

Similar Messages

Maybe you are looking for