Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

ACL Logging

I am trying to find what ports are being blocked via an access list on a switch.  I want to do this via logging on an SSH session and/or console.  I have done the following:

1.  I am using ssh and have turned on 'term mon'

2.  I have set 'logging console informational' and 'logging monitor informational'

3.  The access list has the following lines:

       deny tcp any host 192.168.1.5 log

       deny icmp any host 192.168.1.5 log

       deny tcp any host 192.168.1.6 log

       permit ip any any

4.  Interface has been configured with 'ip access-group TestACL in'

In my SSH session or when consoled directly into the switch, I am seeing no messages appearing when trying to say ping 192.168.1.5.  The ping is being blocked as it should.  Can anyone give me any guidiance?  I don't beleive I am missing anything.

Thanks.

  • LAN Switching and Routing
Everyone's tags (3)
9 REPLIES
Hall of Fame Super Silver

Re: ACL Logging

What you are describing sounds like it should work. Can you post the output of show log? The first set of lines give status of logging and might shed some light on the issue.

HTH

Rick

Sent from Cisco Technical Support iPhone App

New Member

Re: ACL Logging

Here is the output for the 'show log':

Syslog logging: enabled (0 messages dropped, 0 messages rate-limited, 0 flushes, 0 overruns, xml disabled, filtering disabled)

No Active Message Discriminator.

No Inactive Message Discriminator.

    Console logging: level informational, 20 messages logged, xml disabled,

                     filtering disabled

    Monitor logging: level informational, 3 messages logged, xml disabled,

                     filtering disabled

    Buffer logging:  level debugging, 920 messages logged, xml disabled,

                     filtering disabled

    Exception Logging: size (4096 bytes)

    Count and timestamp logging messages: disabled

    File logging: disabled

    Persistent logging: disabled

No active filter modules.

    Trap logging: level informational, 23 message lines logged


The console does show when a interface goes down and up, so I don't believe it is an issue with teh console feature.

Hall of Fame Super Silver

ACL Logging

Thanks for posting the logging output. It does seem to be normal and based on this I would expect your logging to work. And in fact I believe that the problem is not with logging but is with your access list. You have this access list entry

    deny icmp any host 192.168.1.5 log

and the access list is applied inbound. Assuming that 192.168.1.0 is the network on the interface where the access lsit is applied inbound then on the ICMP the host 192.168.1.5 would be the source address but your access list is looking for it as the destination. If you added this line to the access list (and be sure to put it befor the permit ip any any) then I believe that you will see log messages

    deny icmp host 192.168.1.5 any log

Give that a try and let us know how it works.

HTH

Rick

New Member

Re: ACL Logging

The access list is being applied to a switch port inbound.  The computer on that switch port is on 192.168.2.0 network.  The ping is coming from the computer attached to that port (192.168.2.50) to the server (192.168.1.5).  When I try the reverse access rule (deny icmp host 192.168.1.5 any log) the ping is not blocked.

Hall of Fame Super Silver

ACL Logging

Thanks for the clarification. Obviously my theory of the problem was misplaced and reflects that fact that I do not have much understanding of your network. Perhaps you can post the config (or at least the interface and access list parts) so that I can get a better understanding of the environment.

HTH

Rick

New Member

Re: ACL Logging

logging console informational

logging monitor informational


ip access-list extended TestACL

deny   icmp any host 192.168.1.5 log

permit ip any any

interface FastEthernet0/3

switchport access vlan 2

switchport mode access

ip access-group TestACL in

spanning-tree portfast

That is pretty much all I have related to my current problem.  I took out the other access rules and just have the one for testing.

Silver

ACL Logging

Hi,

Which switch model and IOS version you are using? To my knowledge the majority of switches do not support port ACL logging. You should consult the appropriate configuration guide if this is your case.

Best regards,

Antonin

New Member

Re: ACL Logging

Switch model is 3560-C and IOS Version 12.2(55)EX3

I was thinking that could be an issue was not sure.  We do have a 3750 running 12.2(55)SE5 that seems to support it.

Hall of Fame Super Silver

Re: ACL Logging

Thanks for posting the additional information that I asked for. Realizing that it is a VACL (access list applied to a VLAN access port) rather than a traditional access list on a layer 3 interface does shed light on why the logging function is not working as expected.

HTH

Rick

648
Views
5
Helpful
9
Replies