Got it
Enterprise
Community Forums Switches
ACL Logging - Not able to...

ACL Logging - Not able to generate logs after

Created: Dec 30, 2017 18:00:36Latest reply: Sep 16, 2018 12:23:32 3179 3 0 0
  Rewarded HiCoins： 0 (problem resolved)
display all floors #1

Hi all,


I'm trying to log an ACL rule when it is hitted, but I'm not able to do it. 


What I need is: when there is a match on any rule of an ACL, switch need to generate a log like below.

Thi would be the expected output:

ACLE/4/ACLLOG:[STRING]
[tr]Parameter NameParameter Meaning[/tr]
[STRING]Indicates the ACL number, deny/permit rule, interface name, time range, source MAC address, destination MAC address, protocol type, source IP address, source port number in UDP or TCP packets, destination IP address, destination port number in UDP or TCP packets.

rule (advanced ACL view)
logging
Specifies the log recording IP information about packets that match the rule.
NOTE:
  • The logging only takes effect when the traffic-filter command references ACLs. (If the permitparameter is specified, the log does not record the IP information about packets.)
  • The logging only takes effect when the deny is specified and the traffic-policy command references ACLs.


This is my configuration:

acl name ACL-OUT 3998 
rule 10 deny icmp logging 
rule 15 deny tcp destination-port eq www logging 
rule 20 permit ip logging
#
interface GigabitEthernet0/0/25 
port link-type access 
port default vlan 2030 s
stp bpdu-filter enable 
traffic-filter outbound acl name ACL-OUT 
undo lldp enable


I'm running VRP V200R010C00SPC600 on S6720.

I appreciate any help.
  • x
  • convention：

I have this problem too (0) Favorite(0) Share Report
Previous: block mac address
Next: Tunnel Interface Layer 2 on the S5700-28C-EI
Featured Answers

Recommended answer

(1) (1)
Martian_superman
Created Sep 16, 2018 12:23:32 Helpful(1) Helpful(1)

Good day!

Yes, S6720 can log ACL matches only in the inbound direction. It's a platform limitation.

But the ACL logging configuration is OK. You can test it at the inbound direction.
View more
  • x
  • convention：
All Answers
user_2844477
user_2844477 Created Jan 1, 2018 13:57:30 Helpful(0) Helpful(0)

This post was last edited by user_2844477 at 2018-01-18 01:23. I just found out that if I apply the ACL in the INBOUND direction, log is performed.

Would this be a limitation of Huawei switch? Is it just possible to log ACLs when it is applied in the outbound direction?
View more
  • x
  • convention：
user_2844477
user_2844477 Created Jan 26, 2018 03:15:41 Helpful(0) Helpful(0)

I was told by Huawei TAC that S6720 can log ACL matches only in the inbound direction. It's a platform limitation.
View more
  • x
  • convention：
Martian_superman
Martian_superman Created Sep 16, 2018 12:23:32 Helpful(1) Helpful(1)

Good day!

Yes, S6720 can log ACL matches only in the inbound direction. It's a platform limitation.

But the ACL logging configuration is OK. You can test it at the inbound direction.
View more
  • x
  • convention：
Back to list

Comment

Advanced
B Color Image Link Quote Code Smilies
You need to log in to comment to the post Login | Register
Comment

Notice: To protect the legitimate rights and interests of you, the community, and third parties, do not release content that may bring legal risks to all parties, including but are not limited to the following:
  • Politically sensitive content
  • Content concerning pornography, gambling, and drug abuse
  • Content that may disclose or infringe upon others ' commercial secrets, intellectual properties, including trade marks, copyrights, and patents, and personal privacy
Do not share your account and password with others. All operations performed using your account will be regarded as your own actions and all consequences arising therefrom will be borne by you. For details, see " Privacy."

My Followers

Login and enjoy all the member benefits

Login
Huawei Website Support About Huawei Privacy User Agreement Terms of Use Cookie Settings
Huawei Enterprise Huawei Carrier Forum Training & Certification

Copyright © 2020 Huawei Technologies Co., Ltd. All rights reserved.

APP

Huawei Enterprise Support Community
Huawei Enterprise Support Community
Block
Are you sure to block this user?
Users on your blacklist cannot comment on your post,cannot mention you, cannot send you private messages.
Reminder
Please bind your phone number to obtain invitation bonus.