ACL Logging

[webmastadj]

I am trying to find what ports are being blocked via an access list on a switch.  I want to do this via logging on an SSH session and/or console.  I have done the following:

1.  I am using ssh and have turned on 'term mon'

2.  I have set 'logging console informational' and 'logging monitor informational'

3.  The access list has the following lines:

       deny tcp any host 192.168.1.5 log

       deny icmp any host 192.168.1.5 log

       deny tcp any host 192.168.1.6 log

       permit ip any any

4.  Interface has been configured with 'ip access-group TestACL in'

In my SSH session or when consoled directly into the switch, I am seeing no messages appearing when trying to say ping 192.168.1.5.  The ping is being blocked as it should.  Can anyone give me any guidiance?  I don't beleive I am missing anything.

Thanks.

[Richard Burts]

What you are describing sounds like it should work. Can you post the output of show log? The first set of lines give status of logging and might shed some light on the issue.

HTH

Rick

Sent from Cisco Technical Support iPhone App

[webmastadj]

Here is the output for the 'show log':

Syslog logging: enabled (0 messages dropped, 0 messages rate-limited, 0 flushes, 0 overruns, xml disabled, filtering disabled)
No Active Message Discriminator.
No Inactive Message Discriminator.
    Console logging: level informational, 20 messages logged, xml disabled,
                     filtering disabled
    Monitor logging: level informational, 3 messages logged, xml disabled,
                     filtering disabled
    Buffer logging:  level debugging, 920 messages logged, xml disabled,
                     filtering disabled
    Exception Logging: size (4096 bytes)
    Count and timestamp logging messages: disabled
    File logging: disabled
    Persistent logging: disabled
No active filter modules.
    Trap logging: level informational, 23 message lines logged

The console does show when a interface goes down and up, so I don't believe it is an issue with teh console feature.

[Richard Burts]

Thanks for posting the logging output. It does seem to be normal and based on this I would expect your logging to work. And in fact I believe that the problem is not with logging but is with your access list. You have this access list entry

    deny icmp any host 192.168.1.5 log

and the access list is applied inbound. Assuming that 192.168.1.0 is the network on the interface where the access lsit is applied inbound then on the ICMP the host 192.168.1.5 would be the source address but your access list is looking for it as the destination. If you added this line to the access list (and be sure to put it befor the permit ip any any) then I believe that you will see log messages

    deny icmp host 192.168.1.5 any log

Give that a try and let us know how it works.

HTH

Rick

[webmastadj]

The access list is being applied to a switch port inbound.  The computer on that switch port is on 192.168.2.0 network.  The ping is coming from the computer attached to that port (192.168.2.50) to the server (192.168.1.5).  When I try the reverse access rule (deny icmp host 192.168.1.5 any log) the ping is not blocked.

[Richard Burts]

Thanks for the clarification. Obviously my theory of the problem was misplaced and reflects that fact that I do not have much understanding of your network. Perhaps you can post the config (or at least the interface and access list parts) so that I can get a better understanding of the environment.

HTH

Rick

[webmastadj]

logging console informational
logging monitor informational

ip access-list extended TestACL
 deny   icmp any host 192.168.1.5 log
 permit ip any any
interface FastEthernet0/3
 switchport access vlan 2
 switchport mode access
 ip access-group TestACL in
 spanning-tree portfast

That is pretty much all I have related to my current problem.  I took out the other access rules and just have the one for testing.

[amikat]

Hi,

Which switch model and IOS version you are using? To my knowledge the majority of switches do not support port ACL logging. You should consult the appropriate configuration guide if this is your case.

Best regards,

Antonin

[webmastadj]

Switch model is 3560-C and IOS Version 12.2(55)EX3

I was thinking that could be an issue was not sure.  We do have a 3750 running 12.2(55)SE5 that seems to support it.

[Richard Burts]

Thanks for posting the additional information that I asked for. Realizing that it is a VACL (access list applied to a VLAN access port) rather than a traditional access list on a layer 3 interface does shed light on why the logging function is not working as expected.

HTH

Rick