Enable ACL “deny” or “permit” logging (2023)

• Test your network to ensure that your ACL configuration is detecting and denying or “permitting” the IPv4 traffic you do not want forwarded.

• Receive notification when the switch detects attempts to forward IPv4 traffic you have designed your ACLs to reject (deny) or allow (permit).

These requirements are described in more detail in Enabling ACL logging on the switch.

When the switch detects a packet match with an ACE and the ACE includes either the deny or permit action and the optional log parameter, an ACL log message is sent to the designated debug destination.

The first time a packet matches an ACE with deny or permit and log configured, the message is sent immediately to the destination and the switch starts a wait-period of approximately five minutes. (The exact duration of the period depends on how the packets are internally routed.) At the end of the collection period, the switch sends a single-line summary of any additional “deny” or “permit” matches for that ACE (and any other “deny” or “permit” ACEs for which the switch detected a match).

If no further log messages are generated in the wait-period, the switch suspends the timer and resets itself to send a message as soon as a new “deny” or “permit” match occurs. If subsequent packets matching the already logged ACL entries are detected, then a new logged event will be generated that summarizes the number of packets that matched each specific entry (with the time period). The data in the message includes the information illustrated in Content of a message generated by an ACL-deny action.

HP Switch(config)# ip access-list extended NO-TELNETHP Switch(config-ext-nacl)# remark "DENY 10.10.10.3 TELNET TRAFFIC IN"HP Switch(config-ext-nacl)# deny tcp host 10.10.10.3 any eq telnet logHP Switch(config-ext-nacl)# permit ip any anyHP Switch(config-ext-nacl)# exitHP Switch(config)# logging 10.10.20.3HP Switch(config)# logging facility syslogHP Switch(config)# debug destination loggingHP Switch(config)# debug destination sessionHP Switch(config)# debug aclHP Switch(config)# write memHP Switch(config)# show debug Debug Logging Destination: Logging -- 10.10.20.3 Facility = syslog Session Enabled debug types: event acl logHP Switch(config)# show access-list configip access-list extended "NO-TELNET" 10 remark "DENY 10.10.10.3 TELNET TRAFFIC" 10 deny tcp 10.10.10.5 0.0.0.0 0.0.0.0 255.255.255.255 eq 23 log 20 permit ip 0.0.0.0 255.255.255.255 0.0.0.0 255.255.255.255 exit

By default, the wait period for logging "deny" matches (described above in "ACL Logging Operation") is approximately five minutes (300 seconds). You can manually set the wait period timer to an interval between 30 and 300 seconds, using the access-list command from the config context. This setting is stored in the switch configuration.

Syntax:

ACL statistics counters provide a means for monitoring ACL performance by using counters to display the current number of matches the switch has detected for each ACE in an ACL assigned to a switch interface. This can help in determining whether a particular traffic type is being filtered by the intended ACE in an assigned list, or if traffic from a particular device or network is being filtered as intended.

Syntax: