Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

Logging (firewall)

Is there any command that disables the logging at once regarding access lists?

Thank you.

1 ACCEPTED SOLUTION

Accepted Solutions
Cisco Employee

Re: Logging (firewall)

You want to disable all logging on the firewall (assuming it is an ASA)??? If yes, you can do no logging enable to disable all logging. The output should look something like this.

ASA3# sh logging
Syslog logging: disabled

HTH,

jerry

5 REPLIES

Re: Logging (firewall)

Is there any command that disables the logging at once regarding access lists?

Thank you.

Hi,

By default, logging message 106023 (default severity level 4, warnings) is generated when a deny access list entry is matched with a traffic flow. Only the overall ACL is listed in the message, with no reference to the actual denying ACL entry.
You can log messages when specific access control entries (ACEs, or individual permit/deny statements within an ACL) permit or deny a traffic flow by adding the log keyword to an ACE.

You can set the logging severity level on a per-ACE basis if needed. Otherwise, severity level 6 is the default.

Firewall(config)# access-list acl_name [extended] {permit | deny} ... log [level] [interval seconds]

Enter the access list entry normally, but add the log keyword at the end. If you want to log activity on this entry at a severity level other than 6, specify the level (1 to 7) too.

You can also re-enter the ACE with the log disable keywords to completely disable all ACE logging (both message IDs 106100 and 106023). In this case, the sample command would be re-entered as

Firewall(config)# access-list acl_out permit tcp any host 192.168.199.100 eq www log disable

Hope to Help !!

If helpful do rate the post

Ganesh.H

New Member

Re: Logging (firewall)

So, there is no command that disables the logging of the firewall without going through all ACEs and adding the "log disable"?

Thanks for your answer.

Cisco Employee

Re: Logging (firewall)

You want to disable all logging on the firewall (assuming it is an ASA)??? If yes, you can do no logging enable to disable all logging. The output should look something like this.

ASA3# sh logging
Syslog logging: disabled

HTH,

jerry

Silver

Re: Logging (firewall)

So what's the difference between these two?

access-list acl_out permit tcp any host 192.168.199.100 eq www log disable

and

access-list acl_out permit tcp any host 192.168.199.100 eq www
New Member

Re: Logging (firewall)

Answer is already given

639
Views
0
Helpful
5
Replies