Reading The Ip-Acl Log Dump - Cisco MDS 9000 Series Configuration Manual

Reading the IP-ACL Log Dump

switch# show ipv6 access-list
switch# show ipv6 access-list
IPv6 access list copp-system-acl-bgp6
IPv6 access list copp-system-acl-icmp6
IPv6 access list copp-system-acl-icmp6-msgs
IPv6 access list copp-system-acl-ntp6
IPv6 access list copp-system-acl-ospf6
IPv6 access list copp-system-acl-pim6
IPv6 access list copp-system-acl-radius6
Displays a Summary of the Specified IPv6-ACL
switch# show ipv6 access-list abc
Reading the IP-ACL Log Dump
Use the LogEnabled check box option during IP filter creation to log information about packets that match
this filter. The log output displays the ACL number, permit or deny status, and port information.
Use the log-deny option at the end of a filter condition to log information about packets that match dropped
entries. The log output displays the ACL number, permit or deny status, and port information.
Note To capture these messages in a logging destination, you must configure severity level 7 for the kernel and
ipacl facilities and severity level 7 for the logging destination: logfile, monitor.
switch# configure terminal
switch(config)# logging level kernel 7
switch(config)# logging level ipacl 7
switch(config)# logging logfile message 7
For the input ACL, the log displays the raw MAC information. The keyword "MAC=" does not refer to
showing an Ethernet MAC frame with MAC address information. It refers to the Layer 2 MAC-layer
information dumped to the log. For the output ACL, the raw Layer 2 information is not logged.
The following example is an input ACL log dump:
Jul 17 20:38:44 excal-2
%KERN-7-SYSTEM_MSG:
Cisco MDS 9000 Series Security Configuration Guide, Release 8.x
110
10 permit tcp any gt 1024 any eq bgp
20 permit tcp any eq bgp any gt 1024
10 permit icmp any any echo-request
20 permit icmp any any echo-reply
10 permit icmp any any router-advertisement
20 permit icmp any any router-solicitation
30 permit icmp any any nd-na
40 permit icmp any any nd-ns
50 permit icmp any any mld-query
60 permit icmp any any mld-report
70 permit icmp any any mld-reduction
10 permit udp any any eq ntp
20 permit udp any eq ntp any
10 permit 89 any any
10 permit 103 any ff02::d/128
20 permit udp any any eq pim-auto-rp
Configuring IPv4 and IPv6 Access Control Lists