A traffic policy has been configured on a device to redirect packets. To redirect the packets from a certain IP address, the administrator adds a rule to the ACL used by the traffic policy following the ACL configuration guidelines. The new rule uses this source IP address as the matching condition. However, the IP address wildcard mask in the rule is incorrectly configured. As a result, BGP packets cannot be sent to the CPU, and most services are interrupted.
The new rule is as follows:
rule 100 permit ip source 10.1.1.3 255.255.255.255
The IP address wildcard mask is 255.255.255.255, which is not an inverse mask. This rule is equivalent to "rule 100 permit ip" and "rule 100 permit ip source any", meaning that packets from any IP address are matched.
The traffic policy using this ACL has been applied to a large number of interfaces, so all BGP packets received by these interfaces are redirected to other interfaces, but not sent to the CPU. The device times out to process protocol packets and most services are interrupted.
The modified rule is as follows:
rule 100 permit ip source 10.1.1.3 0.0.0.0 //IP address of a single host only when the IP address wildcard mask is 0.0.0.0.
Services are recovered, and packets from the source IP address of 10.1.1.3 are redirected correctly.