topic Hi, in Network Security

ASA ACL logging

Chekol Retta — Tue, 12 Mar 2019 08:22:37 GMT

Hello

I have an access-list with permit ip any any at the bottom configured and applied to an interface. The reason I am permitting any traffic at the bottom is not to adversely affect legitimate traffic until I know the environment. When I do show access-list, the hit count for ip any any increments, but don't see the source and destination ip addresses hitting the access-list. Is this not the best way to see what is hitting the access-list?

Hi,

Aditya Ganjoo — Mon, 10 Oct 2016 19:59:06 GMT

Hi,

You can check the real time logging on the ASDM for real time hits.

Go to the monitoring tab on the ASDM and click on logging tab.

Alternatively you can use the logging keyword in the ACL statement as well:

http://www.cisco.com/c/en/us/td/docs/security/asa/asa82/configuration/guide/config/acl_logging.html

hostname(config)# access-list TEST permit ip any any log

Regards,

Aditya

Please rate helpful posts and mark correct answers.

Hi Aditya

Chekol Retta — Mon, 10 Oct 2016 20:21:36 GMT

Hi Aditya

Yes the ACL is configured with the log keyword at the end. I also have permit ip 10.0.0.0 255.255.0.0 10.10.0.0 255.255.0.0 log 7 and permit tcp 192.168.0.0 255.255.255.0 10.10.0.0 255.255.0.0 log configured. None of them shows the detail.

Hi,

Aditya Ganjoo — Tue, 11 Oct 2016 03:46:12 GMT

Hi,

Can you share the output of sh run logging ?

sh logging should typically show it if logging is enabled.

Regards,

Aditya

Please rate helpful posts and mark correct answers.