cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements
Join Customer Connection to register!
297
Views
5
Helpful
2
Replies
Highlighted
Beginner

PACL on egress

Hello, 

 

I recently created a PACL and applied it on the egress of a 4500 L3 switch. This application included the "deny any any log". According to the document listed below, which is applicable to my current platform, egress PACLs are supported as long as the hardware can support it. It also states that ACL logging on egress is not permitted. However, my PACL is working properly and logging is working as it should. The PACL is staying active, counters are incrementing and the logging is doing its job.  

 

I cannot figure out why logging is working based on documentation. Can anyone point me to a document that shows that an ACE log parameter is supported on PACLs applied in the outbound direction or explain why it would be working when it shouldn't be according to Cisco?

 

 
See the section below:
 
"

When configuring PACLs, consider these guidelines:

  • There can be at most one IPv4, one IPv6, and one MAC access list applied to the same Layer 2 interface per direction.
....
  • If insufficient hardware resources exist to program the PACL, the output PACL is not applied to the port, and you receive a warning message.
"
 
 
2 REPLIES 2
Highlighted
Hall of Fame Expert

Hi,

The input ACL logging option is supported, although logging is not supported for output ACLs.

If it is all working for you, then this is probably a documentation issue.

HTH

Highlighted

Right. That was my reason for the question. The documentation states it's only supported inbound so I guess you're right, it's a documentation error. It's working for me. 

Content for Community-Ad