DACL logging in ISE

[cajones]

I was told you can not use the "log" option on a DACL so I'm wondering how you fine-tune your DACLs?  I don't want to put a deny ip any any and have no way of knowing what ports are being blocked.

[Francesco Molino]

Hi

There was a bug but it has been solved. Even some other keywords like ESTABLISHED are for example shown as error in ise when validating dACL but still working. 

Also, Cisco is using log keyword in their documentation :

http://www.cisco.com/c/en/us/support/docs/lan-switching/8021x/119374-technote-dacl-00.html

It's been a long time I've not done any deployments with log keyword but it should work as when migrating to dot1x we prefer testing the acl before to not get a lot of logs. 

Did you test it?

Thanks 

PS: Please don't forget to rate and mark as correct answer if this solved your issue 

[cajones]

Thank you for this information.  I'll read through the document and try that out.  Our test environment was setup but the DACLs had permit ip any any at the end so we could get it all running.  Now we want to fine-tune and lock it down before we go into production so I was hoping to use the log command when I change it to deny to see what other ports might be getting blocked, if any.  I'll definitely get back to you.

[Francesco Molino]

Hi

ok no problem.

I'm doing dot1x since many years and I would recommend to test your acl before going in production even if you use log keywords. The success of a dot1x is based on user feeling. If you deploy acls with deny and it will not work (even if you correct your acl quickly), your project overall feeling will be very bad.

thanks

PS; Please don't forget to rate and mark as correct answer if this solved your issue