Cisco IP Access List Logging

A Cisco IOS Access Control list (ACL) is used to define traffic. Once that "interesting" traffic is defined, some action can then be taken on that traffic.

Logging messages about packets permitted or denied by an IP access list is also available in Cisco IOS. Logging-enabled ACLs provide insight into traffic as it traverses the network or is dropped by network devices. Any packet that matches the access list will cause an informational logging message about the packet to be sent to the console.

You can monitor how many packets are being permitted or denied by a particular access list, including the source address of each packet.

To enable logging to all enabled destinations, configuring the following:

logging on

Configure the host to which syslog messages will be sent:

logging 10.0.0.1

where 10.0.0.1 is the IP address of your log server (configured as a Syslog server)

access-list 1 permit 1.2.0.0 0.0.255.255 log
access-list 1 deny 1.3.0.0 0.0.255.255 log

To see log generated, simple execute:

show log