Nexus 5000 ACL logging

[kohsei.kadohno]

Hi,

I want to know how to logging the ACL hit information on Nexus 5000.

The optional "log" syntax was refused though I tried to configure as follows.

----

N5K-01(config)# ip access-list test-acl
N5K-01(config-acl)# permit ip host 10.1.1.1 any log
                                                               ^
% Invalid ip address at '^' marker.
N5K-01(config-acl)# permit ip host 10.1.1.1 any ?
  <CR>
  dscp        Match packets with given dscp value
  fragments   Check non-initial fragments
  precedence  Match packets with given precedence value

N5K-01(config-acl)#

----

But the "log" is included in the Syntax Description of below reference.

http://www.cisco.com/en/US/partner/docs/switches/datacenter/nexus5000/sw/command/reference/rel_5_0/security_cmd_ref.html#wp1481494

The plattform is N5K-C5548P, and NS-OS is version 5.0(3)N1(1b).

Please advise.

Thanks.

[George Karavitis]

Hello Kohsei,

I am only replying because I am facing exactly the same problem on 2 different environments, on the same 5k systems as yours.

I really hope we get an answer, but if in the meanwhile you figure it out please post the answer here for the rest of us.

rGrds

George Karavitis

[Lucien Avramov · Accepted solution]

Thanks for pointing this out, we are tracking this fix with : CSCti31305

We will address this documentation omission.

[kohsei.kadohno]

Thank you.

[v-crsimp]

Did you figure this one out?

Craig

[eric.long]

NX-OS 5.2(1)N1(1) introduced logging of an ACL on the mgmt0 interface. 

http://www.cisco.com/en/US/docs/switches/datacenter/nexus5000/sw/release/notes/Rel_5_2_1_N1_1/Nexus5000_Release_Notes_5_2_1_N1.html

[Michael Greene]

I am experiencing the same issue. I am trying to log on a deny statement "deny ip any any log". The result is "ERROR: policy rule not supported". I am running release version 5.2(1)N1(1) on a Nexus 5548UP. If I create a simple one line ACL with log at the end, it seems to work, I don't get the error anyway. However, when I include the log statement in my larger ACL, I get the error. Even when I try to edit the ACL, removing the deny ip any any and add the deny ip any any log statement to the existing ACL I get the error.

Thanks,

Mike