Applying The Time Range To An Ace; Logging Access List Activity; Access List Logging Overview - Cisco 7604 Configuration Manual

Chapter 13 Identifying Traffic with Access Lists
The following is an example of a weekly periodic time range from 8:00 a.m. to 6:00 p.m on weekdays.:
hostname(config)# time-range workinghours
hostname(config-time-range)# periodic weekdays 8:00 to 18:00

Applying the Time Range to an ACE

To apply the time range to an ACE, enter the following command:
hostname(config)# access-list access_list_name [extended] {deny | permit}...[time-range
name]
See the
syntax.
If you also enable logging for the ACE, use the log keyword before the time-range keyword. If you
Note
disable the ACE using the inactive keyword, use the inactive keyword as the last keyword.
The following example binds an access list named "Sales" to a time range named "New_York_Minute."
hostname(config)# access-list Sales line 1 extended deny tcp host 209.165.200.225 host
209.165.201.1 time-range New_York_Minute

Logging Access List Activity

This section describes how to configure access list logging for extended access lists and Webtype access
lists.
This section includes the following topics:
•
•
•

Access List Logging Overview

By default, when traffic is denied by an extended ACE, the FWSM generates system log message 106023
for each denied packet, in the following form:
%XXX-106023: Deny protocol src [interface_name:source_address/source_port] dst
interface_name:dest_address/dest_port [type {string}, code {code}] by access_group acl_id
If the FWSM is attacked, the number of system log messages for denied packets can be very large. We
recommend that you instead enable logging using system log message 106100, which provides statistics
for each ACE and lets you limit the number of system log messages produced. Alternatively, you can
disable all logging.
Catalyst 6500 Series Switch and Cisco 7600 Series Router Firewall Services Module Configuration Guide using ASDM
OL-20748-01
"Adding an Extended Access List" section on page 13-6
Access List Logging Overview, page 13-25
Configuring Logging for an ACE, page 13-26
Managing Deny Flows, page 13-27
Logging Access List Activity
for complete access-list command
13-25