Switches, Hubs, and Modems
cancel
Showing results for 
Search instead for 
Did you mean: 

5308xl ACL Logging Issue

Shawn Kilgore
Occasional Visitor

5308xl ACL Logging Issue

I have setup and applied an Access Control List which blocks a few ports and applied it to the INCOMING side of our local VLAN. The ACL works as desired.

The trouble is that I have added the LOG parameter to my DENY entries which should send debug messages to my syslog server whenever the ACL denies a packet. It is not doing so.

I have already ran these commands:

"DEBUG ACL" to enable logging on ACL deny events
"LOGGING x.x.x.x" to point the switch to the syslog server
"DEBUG DESTINATION LOGGING" and "DEBUG DESTINATION SESSION" to specify that I want logging to go to my syslog server AS WELL AS the console session

When I run a "SHOW DEBUG" things look perfect. Except that ACL denies don't seem to be generating ANY log entries relating to ACL denials, even to the console session (though it IS denying properly).

Regular event log stuff DOES get succesfully sent to my syslog server, so I know it works.

I am running the Kiwi Syslog Daemon for windows and it is set to receive DEBUG level events and up.

Any thought on what I am missing?

Thanks,

Shawn
4 REPLIES
Shawn Kilgore
Occasional Visitor

Re: 5308xl ACL Logging Issue

Does anyone have any ideas on this issue. It would be VERY useful to be able to see this logging.

Thanks,
Shawn
Stuart Teo
Trusted Contributor

Re: 5308xl ACL Logging Issue

did you stick a sniffer (ethereal?) on the kiwi side to make sure that it isn't a kiwi configuration problem?
If a problem can be fixed, there's nothing to worry. If a problem can't be fixed, worrying ain't gonna help. Bottom line: don't worry.
Shawn Kilgore
Occasional Visitor

Re: 5308xl ACL Logging Issue

No I haven't.

But, Kiwi is displaying debug level events for other devices. Plus, if I have SESSION set as one of my debug destinations, I should be seeing the events in telnet, right?
Stuart Teo
Trusted Contributor

Re: 5308xl ACL Logging Issue

right. what's the logging level for debug? 7, right? is it 7 on both ends?
If a problem can be fixed, there's nothing to worry. If a problem can't be fixed, worrying ain't gonna help. Bottom line: don't worry.