ASA ACL Log

[fasteddye]

I am in the process of reviewing and cleaning up an inherited ASA.  There is an ACL on a particular interface that is receiving a lot of hits because it is set to any any with protocol ip.  I take it that is allowing all traffic .  I would like to view the actual traffic that passes on this particular ACL so I can setup more restrictive ACLs and do away with this wide open ACL.

[Maykol Rojas]

Hi

That is not really the way to go, for one hand, even unstrusted traffic or traffic that can be malicious can be flowing thru that ACL, so if you set logging, you will be able to see the packets hitting there, you will think well thats normal and then set an acl to let it in...

Best approach is harden what is exactly that you need to allow to your network and narrow down the policies like that.

But in any case, if you want still going this way, put log at the end of the ACL with the permit ip any any, you will be able to see source, destinations and ports.

Mike