zone-based fireall class-map access-list with 'log' not supported...

Unanswered Question
Sep 7th, 2008

I'm using IOS (c3845-advipservicesk9-mz.124-15.T3) zone-based firewall on a 3845 router and when I enable logging on an extended access list (permit ip any any log) that I have applied to a class-map, I get the following message:

"class-map my_cl_map : access-list with 'log' not supported, pls remove 'log' from access-list otherwise class-map my_cl_map will not work properly"

Any ideas what this means? If I apply permit any any log again, it will take it. But what are the consequences?

Relevant config:

class-map type inspect match-all my_cl_map

match class-map protocols

match access-group name my_acl

ip access-list extended my_acl

permit icmp any any

permit tcp host 192.168.1.1 any eq 1022

permit tcp host 192.168.1.1 any eq 513

permit tcp host 192.168.1.1 any eq 514

permit ip any any log

I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Loading.
y.demissie Mon, 09/08/2008 - 04:56

I'm trying to capture what else is needed by doing "permit ip any any log". However, that's besides the point. Do you know why "log" in access lists applied to class-maps not allowed?

y.demissie Mon, 09/08/2008 - 08:51

In other words, you have no idea what ""class-map my_cl_map : access-list with 'log' not supported, pls remove 'log' from access-list otherwise class-map my_cl_map will not work properly" means.

In other words you don't understand english too well.

"the acl is there to identify traffic for the policy, nothing else. "

Identifying traffic with an ACL using a log option isn't going to identify the traffic correctly. If you want to see what's dropped, use the "drop log" in the policy-map for class class-default.

Actions

This Discussion