ACL not logging?

  • 0
  • 1
  • Problem
  • Updated 3 years ago
  • Solved

Have created a Policy file that has a explicit deny at the end. When I apply it traffic is being blocked that I don't wont.

In order to workout whats wrong I have changed the deny to permit, and added a log, mirror-cpu and count.

The count is increasing at a good rate but nothing is logging, but I can't see anything wrong with my configuration  -  The Vlan 'Accounts' uses subnet 10.10.10.0/24. I believe I could write the deny differently but omitting the source-address field or changing it to 0.0.0.0/0, but it makes no odds as the count is going up so something should be logging?

entry deny {
  if {
    source-address 10.10.10.0/24;
  } then {
    permit;
    mirror-cpu;
    log;
    count dey;
  }
}
configure log filter DefaultFilter add event kern.info

configure access-list Policy_Filename port 1:8 ingress

or

configure access-list Policy_Filename vlan Accounts ingress

I have checked logging is on and working and set from the lowest level of 'warning'.

EXOS version 15.3.1.4 patch 1-3.

Switch: X460-48t

Any idea's what I might be doing wrong?

Thanks in advance

Photo of Martin Flammia

Martin Flammia

  • 6,148 Points 5k badge 2x thumb

Posted 3 years ago

  • 0
  • 1
Photo of Prashanth KG

Prashanth KG, Employee

  • 5,300 Points 5k badge 2x thumb
Hi Martin,

Only the packets that are hitting the CPU can be logged with the ACL modifier. 

Snippet from the concepts guide under the ACL section. 

Packets are logged only when they go to the CPU, so packets in the fastpath are not automaticallylogged. You must use both the mirror-cpu action modifier and the log or log-raw action modifier if you
want to log both slowpath and fastpath packets that match the ACL rule entry. Additionally, Kern.Info
messages (or Kern.Card.Info on SummitStack) are not logged by default. You must configure an EMS
filter to log these messages, for example, configure log filter DefaultFilter add
event kern.info. See the Status Monitoring and Statistics chapter for information about
configuring EMS.

So, if you want to see the packet which is getting denied, please try adding the mirror-cpu action modifier and then check! Hope this helps! 
Photo of Martin Flammia

Martin Flammia

  • 6,148 Points 5k badge 2x thumb

Thanks for replying and excuse me if I have mis-understood, but I'm still not clear what I have done wrong? From what I can tell I am already doing all you have mentioned in the configuration supplied?

Are you able to give an example or detail exactly what I am missing?

Many thanks.

Photo of Prashanth KG

Prashanth KG, Employee

  • 5,300 Points 5k badge 2x thumb
Hi Martin,

Thank you for the quick response. I overlooked the mirror-cpu action in your acl. Sorry about that. 

Can you collect the following outputs:

show log counters kern occurred. 
show configuration ems. 

Thanks
Photo of Martin Flammia

Martin Flammia

  • 6,148 Points 5k badge 2x thumb

Ok, worked out the problem after you gave those commands. I noticed the entry for Kern was showing 'N' even though I had added it to the DefaultFilter.

The answer was that it should be kern.card.info, so the inclusion should be

configure log filter DefaultFilter add event kern.card.info
So problem solved. Thanks very much for you help!

Photo of Prashanth KG

Prashanth KG, Employee

  • 5,300 Points 5k badge 2x thumb
Great! Suspected the same. Thanks for verifying and letting us know!! 
Photo of Stephen Williams

Stephen Williams, Employee

  • 9,034 Points 5k badge 2x thumb
Martin,

We had a KCS article, but it wasn't external facing yet so you would have never found it.  I pushed it out the the public to help others in the future.  Sorry for your troubles.


https://gtacknowledge.extremenetworks.com/articles/How_To/How-to-Capture-received-packets-using-an-A...


Thanks,

Stephen
(Edited)