Best ACL for internet facing port

[CiscoPurpleBelt]

What is the best way to create an ACL to be used on an internet facing edge port to keep the logs down when packets are denied from devices not permitted according to the ACL? Is there anyway to hide the public IP from the internet?

[Philip D'Ath · Accepted solution]

Don't use the "log" keyword for "deny" entries, and you wont get logging entries.

[CiscoPurpleBelt]

Thanks. I know some people keep adding suspect/bad IPs to a deny statement in a ACL which then gets to be very long. I want to keep track of what is going on but yes the log will get pounded.

[CiscoPurpleBelt]

Thanks. I know some people keep adding suspect/bad IPs to a deny statement in a ACL which then gets to be very long. I want to keep track of what is going on but yes the log will get pounded.