Enabling Acl Logging - Cisco 4215 - Intrusion Detection Sys Sensor Configuration Manual

Chapter 10 Configuring Blocking

Enabling ACL Logging

Use the enable-acl-logging [true | false] command in the service network access submode to enable
ACL logging, which causes Network Access Controller to append the log parameter to block entries in
the ACL or VACL. This causes the device to generate syslog events when packets are filtered. Enable
ACL logging only applies to routers and switches. The default is disabled.
To enable ACL logging, follow these steps:
Log in to the CLI using an account with administrator privileges.
Step 1
Enter network access submode:
Step 2
sensor# configure terminal
sensor(config)# service network-access
Enter general submode:
Step 3
sensor(config-net)# general
Step 4 Enable ACL logging:
sensor(config-net-gen)# enable-acl-logging true
Step 5 Verify that ACL logging is enabled:
sensor(config-net-gen)# show settings
general
-----------------------------------------------
To disable ACL logging, use the false keyword:
Step 6
sensor(config-net-gen)# enable-acl-logging false
Step 7 Verify that ACL logging is disabled:
sensor(config-net-gen)# show settings
general
-----------------------------------------------
78-16527-01
log-all-block-events-and-errors: true <defaulted>
enable-nvram-write: false <defaulted>
enable-acl-logging: true default: false
allow-sensor-block: false <defaulted>
block-enable: true <defaulted>
block-max-entries: 250 <defaulted>
max-interfaces: 250 <defaulted>
master-blocking-sensors (min: 0, max: 100, current: 0)
-----------------------------------------------
log-all-block-events-and-errors: true <defaulted>
enable-nvram-write: false <defaulted>
enable-acl-logging: false default: false
allow-sensor-block: false <defaulted>
block-enable: true <defaulted>
block-max-entries: 250 <defaulted>
max-interfaces: 250 <defaulted>
master-blocking-sensors (min: 0, max: 100, current: 0)
-----------------------------------------------
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 5.0
Configuring Blocking Properties
10-11