router acl debug

[hbartz]

Hello, what is the best method to debug specifically router access-control lists in IOS 12.2? I would like to see if they all work as planned. I have debugging enabled on acl interface and tried 'debug ip error access-list ' , but this does not give me output for acls only. Thanks.

[ndoshi · Accepted solution]

Hi ,

Best way to check is by putting log at end of access list

access-list 1 permit 5.6.0.0 0.0.255.255 log

log

(Optional) Causes an informational logging message about the packet that matches the entry to be sent to the console. (The level of messages logged to the console is controlled by the logging console command.)

The message includes the access list number, whether the packet was permitted or denied, the source address, and the number of packets. The message is generated for the first packet that matches, and then at 5-minute intervals, including the number of packets permitted or denied in the prior 5-minute interval.

Nilesh