Acl Logging - Cisco Catalyst 2960 series Configuration Manual

Information About Configuring IPv4 Access Control Lists
Access lists that are applied to interfaces on a device do not filter traffic that originates from that device.
Note
Figure 77: Topology for Applying Access Control Lists
The figure above shows that Device 2 is a bypass device that is connected to Device 1 and Device 3. An
outbound access list is applied to Gigabit Ethernet interface 0/0/0 on Device 1. When you ping Device 3 from
Device 1, the access list does not check for packets going outbound because the traffic is locally generated.
The access list check is bypassed for locally generated packets, which are always outbound.
By default, an access list that is applied to an outbound interface for matching locally generated traffic will
bypass the outbound access list check; but transit traffic is subjected to the outbound access list check.
The behavior described above applies to all single-CPU platforms that run Cisco software.
Note

ACL Logging

The switch software can provide logging messages about packets permitted or denied by a standard IP access
list. That is, any packet that matches the ACL causes an informational logging message about the packet to
be sent to the console. The level of messages logged to the console is controlled by the logging console
commands controlling the syslog messages.
Because routing is done in hardware and logging is done in software, if a large number of packets match
Note
a permit or deny ACE containing a log keyword, the software might not be able to match the hardware
processing rate, and not all packets will be logged.
The first packet that triggers the ACL causes a logging message right away, and subsequent packets are
collected over 5-minute intervals before they appear or logged. The logging message includes the access list
number, whether the packet was permitted or denied, the source IP address of the packet, and the number of
packets from that source permitted or denied in the prior 5-minute interval.
Consolidated Platform Configuration Guide, Cisco IOS Release 15.2(4)E (Catalyst 2960-X Switches)
1182