topic Re: zone-based fireall class-map access-list with 'log' not supp in Network Security

zone-based fireall class-map access-list with 'log' not supported...

ydemissie — Mon, 11 Mar 2019 13:40:58 GMT

I'm using IOS (c3845-advipservicesk9-mz.124-15.T3) zone-based firewall on a 3845 router and when I enable logging on an extended access list (permit ip any any log) that I have applied to a class-map, I get the following message:

"class-map my_cl_map : access-list with 'log' not supported, pls remove 'log' from access-list otherwise class-map my_cl_map will not work properly"

Any ideas what this means? If I apply permit any any log again, it will take it. But what are the consequences?

Relevant config:

class-map type inspect match-all my_cl_map

match class-map protocols

match access-group name my_acl

ip access-list extended my_acl

permit icmp any any

permit tcp host 192.168.1.1 any eq 1022

permit tcp host 192.168.1.1 any eq 513

permit tcp host 192.168.1.1 any eq 514

permit ip any any log

Re: zone-based fireall class-map access-list with 'log' not supp

palomoj — Mon, 08 Sep 2008 03:39:16 GMT

why are you entering a "permit ip any any" in the first place? you first four lines are not even needed if you need the last line in the acl. aren't you trying match on specific traffic?

Re: zone-based fireall class-map access-list with 'log' not supp

y.demissie — Mon, 08 Sep 2008 11:56:19 GMT

I'm trying to capture what else is needed by doing "permit ip any any log". However, that's besides the point. Do you know why "log" in access lists applied to class-maps not allowed?

Re: zone-based fireall class-map access-list with 'log' not supp

palomoj — Mon, 08 Sep 2008 14:31:59 GMT

the acl is there to identify traffic for the policy, nothing else. you can bind another acl on the interface if you need to identify traffic using the log option

Re: zone-based fireall class-map access-list with 'log' not supp

y.demissie — Mon, 08 Sep 2008 15:51:01 GMT

In other words, you have no idea what ""class-map my_cl_map : access-list with 'log' not supported, pls remove 'log' from access-list otherwise class-map my_cl_map will not work properly" means.

Re: zone-based fireall class-map access-list with 'log' not supp

ken.chua — Thu, 19 Feb 2009 03:37:35 GMT

I know what you mean. I would like to see log of deny/allow traffic. I have the same problem.

Re: zone-based fireall class-map access-list with 'log' not supp

palomoj — Thu, 19 Feb 2009 19:42:03 GMT

In other words you don't understand english too well.

"the acl is there to identify traffic for the policy, nothing else. "

Identifying traffic with an ACL using a log option isn't going to identify the traffic correctly. If you want to see what's dropped, use the "drop log" in the policy-map for class class-default.