This site uses cookies. By continuing to browse the site you are agreeing to our use of cookies. Read our privacy policy>

Enterprise
Community Forums Switches
ACL Logging - Not able to...

ACL Logging - Not able to generate logs after

Created: Dec 30, 2017 18:00:36Latest reply: Sep 16, 2018 12:23:32 2599 3 0 0
  Rewarded Hi-coins： 0 (problem resolved)
display all floors #1

Hi all,


I'm trying to log an ACL rule when it is hitted, but I'm not able to do it. 


What I need is: when there is a match on any rule of an ACL, switch need to generate a log like below.

Thi would be the expected output:

ACLE/4/ACLLOG:[STRING]
[tr]Parameter NameParameter Meaning[/tr]
[STRING]Indicates the ACL number, deny/permit rule, interface name, time range, source MAC address, destination MAC address, protocol type, source IP address, source port number in UDP or TCP packets, destination IP address, destination port number in UDP or TCP packets.

rule (advanced ACL view)
logging
Specifies the log recording IP information about packets that match the rule.
NOTE:
  • The logging only takes effect when the traffic-filter command references ACLs. (If the permitparameter is specified, the log does not record the IP information about packets.)
  • The logging only takes effect when the deny is specified and the traffic-policy command references ACLs.


This is my configuration:

acl name ACL-OUT 3998 
rule 10 deny icmp logging 
rule 15 deny tcp destination-port eq www logging 
rule 20 permit ip logging
#
interface GigabitEthernet0/0/25 
port link-type access 
port default vlan 2030 s
stp bpdu-filter enable 
traffic-filter outbound acl name ACL-OUT 
undo lldp enable


I'm running VRP V200R010C00SPC600 on S6720.

I appreciate any help.
  • x
  • convention：

I have this problem too (0) Favorite(0) Share Report
Featured Answers
Martian_superman
Created Sep 16, 2018 12:23:32 Helpful(1) Helpful(1)

Good day!

Yes, S6720 can log ACL matches only in the inbound direction. It's a platform limitation.

But the ACL logging configuration is OK. You can test it at the inbound direction.
  • x
  • convention：
All Answers
user_2844477
user_2844477 Created Jan 1, 2018 13:57:30 Helpful(0) Helpful(0)

This post was last edited by user_2844477 at 2018-01-18 01:23. I just found out that if I apply the ACL in the INBOUND direction, log is performed.

Would this be a limitation of Huawei switch? Is it just possible to log ACLs when it is applied in the outbound direction?
  • x
  • convention：
user_2844477
user_2844477 Created Jan 26, 2018 03:15:41 Helpful(0) Helpful(0)

I was told by Huawei TAC that S6720 can log ACL matches only in the inbound direction. It's a platform limitation.
  • x
  • convention：
Martian_superman
Martian_superman Created Sep 16, 2018 12:23:32 Helpful(1) Helpful(1)

Good day!

Yes, S6720 can log ACL matches only in the inbound direction. It's a platform limitation.

But the ACL logging configuration is OK. You can test it at the inbound direction.
  • x
  • convention：
Back to list

Reply

Reply
Advanced
B Color Image Link Quote Code Smilies
You need to log in to reply to the post Login | Register

Notice Notice: To protect the legitimate rights and interests of you, the community, and third parties, do not release content that may bring legal risks to all parties, including but are not limited to the following:
  • Politically sensitive content
  • Content concerning pornography, gambling, and drug abuse
  • Content that may disclose or infringe upon others ' commercial secrets, intellectual properties, including trade marks, copyrights, and patents, and personal privacy
Do not share your account and password with others. All operations performed using your account will be regarded as your own actions and all consequences arising therefrom will be borne by you. For details, see " Privacy."
If the attachment button is not available, update the Adobe Flash Player to the latest version!
Login and enjoy all the member benefits

Login and enjoy all the member benefits

Login
Huawei Website Support About Huawei Privacy Terms of Use
Huawei Enterprise Huawei Carrier Forum Training & Certification

Copyright © 2019 Huawei Technologies Co., Ltd. All rights reserved.

APP