Nered to know where I can view ACL denies regarding "access-list deny any log" ?

[Yermander]

I ask this question in the context of an SNMP access list. I am guessing that this line of config (access-list deny any log) will allow you to see which addresses were denied SNMP access.

I need to know where I can view the source addresses from where the packets were dropped? Could this be just in sh log? Thanks in advance for any help. Cheers

[Pedro Lereno]

Hi,

Yes, with an extended access-list with the last line:

deny ip any any log

with "sh log" you can  see the source address of the packets being dropped.

Take note that you must be at least in the logging level 6 (informational), by default console and monitor are in level 7 (debugging):

logging console debugging

logging monitor debugging

With older IOS versions (before at least 12.4) you had to add the following lines at the bottom of the acl:

access-list 101 deny   tcp any range 0 65535 any range 0 65535 log
access-list 101 deny   udp any range 0 65535 any range 0 65535 log
access-list 101 deny   icmp any any log
access-list 101 deny   ip any any log

to log the sources and destinations IPs and port numbers.

Best Regards,

Pedro Lereno