Cisco ACL debugging – ip ACL logs do not show ports

During most cisco firewall or router troubleshooting, it is often necessary to trace or log which traffic is traversing the Cisco. Cisco includes a feature called "IP accounting" which is quite useful, but only to report on amount of traffic between two endpoints, or access list violations. Normal IP access lists are much more useful to see which ports hosts are using, and so on. So I applied the access list:

access-list 102 permit ip host any log

Which I thought would log the information I needed (which IPs and ports the host was connecting to). However the log entries were missing the vital port number, for example:

%SEC-6-IPACCESSLOGP: list 102 permitted tcp ->, 9 packets

Note the (0) instead of the port number. I figured that maybe since in this access list i never reference a port number, the cisco never tests which port the client is using and so gives a 0 as a port number. So I modified my ACL to:

access-list 102 permit tcp host eq 0 any eq 0 log

access-list 102 permit ip host any log

Now the cisco should test which port is being used, in fact, checking the logging we see the ports are being logged:

%SEC-6-IPACCESSLOGP: list 102 permitted tcp ->, 1 packet

Good to know! 🙂


One thought on “Cisco ACL debugging – ip ACL logs do not show ports

Leave a Reply

Please log in using one of these methods to post your comment: Logo

You are commenting using your account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

This site uses Akismet to reduce spam. Learn how your comment data is processed.