Cisco CCNA Study Guide - Router Alley

CCNA Study Guide v2.62 – Aaron Balchunas
263
Access List Logging
Consider again the following example:
Assume there is a webserver on the 172.16.x.x network with an IP address
of 172.16.10.10.
We wish to keep track of the number of packets permitted or denied by each
line of an access-list. Access-lists have a built-in logging mechanism for
such a purpose:
Router(config)# access-list 101 permit tcp 172.18.0.0 0.0.255.255 host 172.16.10.10 eq 80 log
Router(config)# access-list 101 deny ip 172.18.0.0 0.0.255.255 172.16.0.0 0.0.255.255 log
Router(config)# access-list 101 permit ip any any log
Notice we added an additional keyword log to each line of the access-list.
When viewing an access-list using the following command:
Router# show access-list 101
We will now have a counter on each line of the access-list, indicating the
number of packets that were permitted or denied by that line. This
information can be sent to a syslog server:
Router(config)# logging on
Router(config)# logging 172.18.1.50
The logging on command enables logging. The second logging command
points to a syslog host at 172.18.1.50.
We can include more detailed logging information, including the source
MAC address of the packet, and what interface that packet was received on.
To accomplish this, use the log-input argument:
Router(config)# access-list 101 permit ip any any log-input
* * *
All original material copyright © 2013 by Aaron Balchunas (aaron@routeralley.com),
unless otherwise noted. All other material copyright © of their respective owners.
This material may be copied and used freely, but may not be altered or sold without the expressed written
consent of the owner of the above copyright. Updated material may be found at http://www.routeralley.com.