Does your access-list have "permit ip .... " or does it have "permit tcp ... "?
With '(0)' the ports are generated when the router didn't know the port numbers rather than them actually being 0. If your access-list doesn't
filter on higher level ports the router doesn't bother parsing the TCP/UDP headers so it can't log the port numbers and just fills in with zeros to keep the format consistent.
eg. The access-list:
access-list 123 permit ip any any log
generates log messages like this:
%SEC-6-IPACCESSLOGP: list 123 permitted tcp 10.0.1.1(0) -> 10.0.1.228(0), 5 packets
with zero ports, whereas the access-list:
access-list 123 permit udp any any range 0 65535 log
access-list 123 permit tcp any any range 0 65535 log
generates log message like this:
%SEC-6-IPACCESSLOGP: list 123 permitted tcp 10.0.1.1(2862) -> 10.0.1.228(25), 5 packets
with non-zero ports.
Steve
