access list doesn't get hits

[katrin1701]

I've got an

access-list

that I'm using for NAT and while it is working, I can't see any hits.

I've seen other posts here that it depends on processing via Hard- or Software.

How do I know if this might be the case?

I'd like to be able to see things in that

access-list

in the log, for examle as in

deny any any log

but that doesn't seem to work either.

Is there any way to make that visible?

[Flavio Miranda]

Hi

 You did not mention the device  but on the Label of your thread it shows ISR4000. This device runs IOS XE. 

Take a look on this link

https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_data_acl/configuration/xe-16-8/sec-data-acl-xe-16-8-book/sec-dply-clr-ald-acl-xe.html 

[katrin1701]

it is an ISR4451 version 17.3

It displays logs for other

access-lists

but not for the NAT

access-list

It might be due to the fact that the outgoing tagged interface are virtual-access interfaces, via a virtual-template, which has ip nat outside as a parameter.

[MHM Cisco World]

if it ISR4451 IOS-XE then there is command I think help you.

[MHM Cisco World]

if this is SW cat9000 then there is chance that NAT is done in TCAM, 
when NAT (and it ACL) done in TCAM there is no log.

[katrin1701]

it is an ISR4451 version 17.3

how does one find ot if it is done in TCAM?

Would that also explain why i can't add remarks to my

access-lists

?

[MHM Cisco World · Accepted solution]

sorry but the command I mentioned before is work only for SW not for router 

show access-list

hardware count 

""NAT does not support access control lists (ACLs) with the log option. The same functionality can be achieved by using one of the following options:

• By having a physical interface or virtual LAN (VLAN) with the logging option

• By using NetFlow""

https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/ipaddr_nat/configuration/xe-16/nat-xe-16-book/iadnat-monmain.html

NAT ACL not support Log as cisco mention in guide.

[katrin1701]

shame, it used to work on a

Cisco IOS Software, C3900 Software (C3900-UNIVERSALK9-M), Version 15.2(4)M7, RELEASE SOFTWARE (fc2)

I don't have the license for NetFlow it seems (but on the first glance it seems way too complicated for my purposes)

and logging on the interface offers

link-status UPDOWN and CHANGE messages
nfas-status NFAS D-channel status messages
subif-link-status Sub-interface UPDOWN and CHANGE messages

which doesn't seem to be what I want either.

I'll just make do without it, I think. At least for now.

[paul driver]

Hello
The nat ACL is used for the rtr to call upon so to translate the address(s) specified in it, so I am not sure why you would want to log that particular

access-list

as whatever is specified is what you wish to translate.

[katrin1701]

I don't understand what a Response Time Reporter has do do with it, so I can't comment on that.

If the system is running normally I don't need to log anything, but just in case I'd like to be able to add a log to look for problems, afaik that's what the option log is used for.

I'd also be happier if I had hits, so I can see that the ACL is in use and working.

I don't understand why it shouldn't be possible.