ACL logging on router for syslog

ACL logging on router for syslog

I need to monitor ports on the router to a particular host to a destination. I have an ACL as shown below

permit log host 192.168.0.10 ip host 10.0.0.1

allow an ip

I have server syslog configuration, I see on the syslog server log messages, but there is no port information.

Log message looks like

"% S-6-acl IPACCESSLOGP:list permits 10.0.0.1 (0)-> 192.168.0.10 (0), xx packages.

I need to know which ports are host 10.0.0.1 uses the server 192.168.0.10

What is the best way to get this information.

Thank you

Dominic provides a creative solution. And according to the requirements of the original post, it could be a very satisfactory solution.

But we can also provide an explanation of the problem and a solution for this. A very simple access list that allows traffic between a specific pair of guests receive the original message and then allow all ip traffic. The access list does not cover all the values for the Protocol ports. And it is the reason for the log messages do not have port information. If the access list does not review the port numbers the message cannot report port numbers. If you want the log message to include port numbers, then you must consider the port numbers in the access list. This version of the list is slightly more complex, but it will provide the port numbers you want:

permit udp host 10.0.0.1 host 192.168.0.10 between 0 65535 Journal

permit tcp host 10.0.0.1 host 192.168.0.10 between 0 65535 Journal

permit log host 192.168.0.10 ip host 10.0.0.1

allow an ip

HTH

Rick

Tags: Cisco Security

Similar Questions

  • How is the ACL name of the router for fleeing?

    I want to test running and have a question, the name of the ACL.

    I configured the device blocking on the IDM,

    -blocking interface Fastethernet0/0 =

    -direction = in

    -Pre IDS_PRE = ACL name

    -Ask the IDS_POST = ACL name

    Change a signature "ICMP-echo" to shunhost and update on the router but added new ACL under Fastethernet0/0 as the name IDS_Fastethernet0/0_in_0 and rocking it with IDS_Fastethernet0/0_in_1.

    Q. why the ACL name not follow my name on the IDM?

    Thanks in advance.

    I think that there is some confusion about what are PreACl and PostACL.

    The PreACL and PostACl entries in IDM do not affect what's name created sensor ACL on the router.

    The sensor will always create an ACL that is named with the following format:

    IDS___<0or1>

    So for you the configuration it would create the following names of ACL:

    IDS_Fastethernet0/0_in_0 and IDS_Fastethernet0/0_in_1

    E he uses 2 ACL because it cannot modify an ACL that is currently applied on the interface. So if ACL 0 is currently applied then it will create 1 ACL and then apply ACLs one (which Désimpute ACL 0).

    The sensor can then remove 0 and create a new ACL 0 when a change has to happen.

    So, what are the pre and Post ACL names used for?

    One of the biggest complaints we had with older versions of the probe was that the user could add no lines to the ACL that created the sensor.

    So we came to the top with the pre and Post ACL so that users can add entries to the ACL that creates the sensor.

    The user must connect on the router itself and create an ACL with little matter the name they want. Inside of the ACL, they put the entries they finally want to see at the top of the ACL that will create the sensor.

    When they set up the sensor, they take the name of the ACL, they created and enter it in the field for the name of PreACL.

    The user can do the same for the entries they want at the bottom of the ACL generated by the sensor by creating another ACL on the router. Put it in the Scriptures they want to see at the bottom of the created sensor ACL and then type the name in the name of PostACL field.

    If the names of pre and Post ACL aren't going to use to name the ACL created sensor.

    But on the contrary these ACL is read out of the router by the sensor, and these ACL entries will be placed inside the ACL, created by the sensor.

  • How to connect success and details of connection attempt failed router to Syslog?

    All,

    How can I configure my router Cisco 837 to log to syslog all successful and attempted connection failed to the router via any interface?  I would like to get very verbose information about attempts to connect (success and failure) as possible, including the source, userid attempted, ip address etc.

    All comments and suggestions would be greatly appreciated!

    James

    Archives
    The config log
    Enable logging
    notify the contenttype in clear syslog
    hidekeys
    opening of session
    192.168.1.1 logging
    block connection-for 60 tent 3 within 60
    connection sur-Echec connect all the 1
    connection on success - open a session every 1

  • ACLs on Cisco router - block outside traffic, allow all inside

    Hello

    I am creating the ACL on the router Cisco that will allow all traffic within internet and don't allow specific traffic on the internet inside.

    This is what I have configured and puted on the interface of the router connected to the ISP:

    10 permits all icmp (411 matches)
    20 permit tcp "my public IP address" no matter what eq 3389 (46400 matches)
    30 permit tcp "my public IP address" no matter what eq 22 (9185 matches)
    40 "my public IP address" ip allow match any (3207)
    50 permit tcp any any eq smtp (11 matches)
    60 permit tcp any any eq www (56 matches)
    70 permit tcp any any eq 443 (29 items)
    80 permit tcp any any eq field (5 matches)
    allowed 81 UDP everything no matter what field of eq (7 matches)
    allowed 82 UDP any eq (10564 matches) field
    83 permit tcp any what eq field everything (10 matches)
    90 permit udp any any eq ntp (13317 matches)
    95 permit tcp 192.168.0.0 0.0.0.255 any
    Dialer interface 1
    IP Access-group 101 IN

    So I can connect to my public IP to the LAN of the customer via RDP and SSH (which is OK), but users of the client cannot access Internet (which is not OK.)!

    Users are all in the same Vlan. Between the interface Vlan and outside interface (dialer 1) Pat.

    There is no other ALC on the router except for PAT.

    What I'm missing here?

    Thank you.

    Is this why 192.168.0.0/24 is present in the list of ACL 101? What is the remote subnet that you connect to port 3389?

    If your local subnet interior is a soldier of the C class, it must be your global external address you want to add to the ACL 101.

    Better yet, run an IPSec tunnel between the sites.

  • Why no implicit route for traffic from IPSec-L2L tunnel?

    In a hub-and-spoke IPSec environment, it is not difficult to implement routing by spoke to the hub.

    But on the side of the hub of a tunnel, where the gateway of last resort for traffic by spoke it, it seems almost counterintuitive than the ACL instructions and even cryptographic doesn't implicitly create a route for the traffic of the station in the tunnel at the end (talk).  It could always be replaced with a static if necessary.

    There is probably a good reason for this, but I can't think of it.  Or am I the only person who thinks it is strange... or maybe an opportunity to feature?

    Hello

    This feature exists and is called reverse road injection. The route is created dynamically (based on ACL Cryptography) and is only available when the SA is up.

    http://www.Cisco.com/en/us/docs/iOS/12_3t/12_3t14/feature/guide/gt_rrie.html

    HTH

    Laurent.

  • R8500: QOS is terrible on this router for $400

    So before you get this router I was using a $20 off of eBay refurbished Linksys router E6500 running DD WRT (Yes, you can run it on this router if you know where to find the firmware for this). In any case, the flow was not the greatest, but I never had problems.

    I have a ReadyNAS RN516 to my office and the backup on my Mac using the time machine office nas. I also have the Charter which gives single 4mbps upload (it's slow, but once he finished the initial and subsequent backup backups are fine). In real life, it's more like 4.75mbps. I have QOS value 3.75 to ensure that my modem is not bufferbloat and kill my connection.

    My problem is however that often my devices slow to a crawl (if more than 5 Ghz wireless or wired) whenever I am downloading. On my other router I just put 4 Mbps as the download limit and all devices than 4mbps equally, and I never had no problem with slowdowns or high pings and lag. No matter what I put the download speed at... He accuses just out for no apparent reason on this router.

    If someone can tell me why free DD WRT software works better than the software on a router for $400? Just curious?

    The new firmware seems to have helped. I changed a few things as well, and it seems to work very well.

    Regarding the comment of routers figure 3 and 4 routers in figure, there must be an improvement on the 2 figure routers and routers multi-3, otherwise what's the point?

    I'm trying the test of the future a little, that's why I chose this router. It doesn't matter if I take it right back and stick with my $ 20 DDWRT router. I do not have the latest and greatest tech (2012 macbook air and several iPhone 6 more ' and a room above the router and I can not even through any speedtests 60mbps (run through the gigabit mac that is wired and I move 65mbps each time.)

    I don't have a fast enough home nas box, but I'd be curious to see wireless local area network speeds. I wonder if I can break even 100 Mbps with this thing...

  • Can what comparison be made between time capsule and Smart RG s505 wireless modem router for wifi

    Can what comparison be made between time capsule and Smart RG s505 wireless modem router for wifi

    Superior...

    After all, the chip is mainly a modem.

    Wireless is there but not designed as the primary connection.

    Wireless 802.11n 300Mbps AP with 2 x 2 MIMO Wireless bridge, WDS multiple SSID, including isolated invited SSID WiFi QoS (WMM) and PowerSave wireless security: • Wi - Fi Protected Access (WPA, WPA2) • AES, TKIP, WEP encryptio

    It is the Wireless N standard.

    The TC is dual-band simultaneous AC1750... even if in fact apple never leaves anything use 300mbit on the 2.4 GHz is more like AC1450... It is also 3 streams on both bands not 2 x 2.

    The fact that aid.

    The only thing to note is that a router from Apple can join never a router wireless not apple... so, there must always be plugged in by ethernet.

  • I have a MN700 router for my wireless. How to reset the password?

    I have a MN700 router for my wireless. How to reset the password?

    I contacted Microsoft via the phone, but because they no longer carry this point they couldn't help me.

    Hello

    1. what operating system is installed on your computer?
    2 did you change your computer, after which the issue started?

    Here is the manual for the device...

    http://download.Microsoft.com/download/b/6/9/b69c956c-85d9-4641-aa6f-1548391e0967/mn700_base_station_configuration_guide.PDF

    Reset the router and set it up as if it was the first time. Then, you can simply choose a new password and security settings.

  • your user profile was not loaded correctly! you have been logged on with a temporary profile. Changes to this profile will be lost when you log out. Please, check your log of events for more information or contact your administrator

    Desperately need help.  I'm supposed to use my computer to type a HUGE Affidavit today and its buggered! Oh no.! Get started with my kids have been playing on my computer and install different games.  So I thought that I do the big thing non-technical MOM and start cleaning up the programs!  Well I accidently deleted NIVIDA and probably something else (I think) and totally messed up my computer!  I have re-uploaded NIVIDA and now my computer "looks like" back to normal, but it throws this error message

    "your user profile was not loaded correctly! you have been logged on with a temporary profile. Changes to this profile will be lost when you log out. Please, check your log of events for more information or contact your administrator"

    and now I can't save anything or find my pictures that I'm desperate for! Can someone please give me a helping hand.  Not technically minded, to take me on as a challenge!  Thanks bunch :) Sarah

    Desperately need help.  I'm supposed to use my computer to type a HUGE Affidavit today and its buggered! Oh no.! Get started with my kids have been playing on my computer and install different games.  So I thought that I do the big thing non-technical MOM and start cleaning up the programs!  Well I accidently deleted NIVIDA and probably something else (I think) and totally messed up my computer!  I have re-uploaded NIVIDA and now my computer "looks like" back to normal, but it throws this error message

    "your user profile was not loaded correctly! you have been logged on with a temporary profile. Changes to this profile will be lost when you log out. Please, check your log of events for more information or contact your administrator"

    and now I can't save anything or find my pictures that I'm desperate for! Can someone please give me a helping hand.  Not technically minded, to take me on as a challenge!  Thanks bunch :) Sarah

    Here is the tutorial to solve this problem. It is very involving. Please read the step by step.
    http://www.Vistax64.com/tutorials/135858-user-profile-error-logged-temporary-profile.html

    t-4-2

  • Need to modernize the modem; How do I 'plan' relocation WRT54G Router for wired / wireless

    I went late to upgrade my modem, and from what I've read in the comments, do a modem/router combo doesn't seem to be the best thing to do in what concerns the issues of reliability and range.  So, I want to upgrade my modem & then use the same router/access point that I currently have.  However, I've read other users with problems by accessing the control panel after you connect to a new modem... so want to know the information that I need to have before starting this project.

    Is this to say that I'm going to basically start early and set up my home network all over again?

    I'm pretty tech-savy... but I do not enough to really launch the project & see where it takes me... I don't have the TIME!  Laughing out loud!

    Thanks for any help/advice anyone can offer!

    Jane

    Really, it depends on the type of settings that your ISP would put on the new modem. If the configuration of the new modem would be the same with the old, so there is no need for you to make any changes on the router. Simply connect the new modem, perform a powercycle by unplugging the power cord from the modem and router and it should work. However, if it is not, what you can do is to reset the router and reconfigure. The following links help you reconfigure the router after a reset.

    Setting up a Linksys router with cable Internet service

    Setting up a Linksys router for DSL Internet connection

    Setting up a router with a static IP address account

  • Where to find the ability auto-raccordement on a router for PPPoE linsys for ADSL connection on request?

    Where to find the ability auto-raccordement on a router for PPPoE linsys for ADSL connection on request?

    Hello

    Use Linksys router information questions.

    Look for the router of the link exact model number.

    http://homesupport.Cisco.com/en-us/support?ICID=global-header-support-link

    See you soon.

  • I'm unable to watch videos on a certain type of site. They all now say, 'file not found '. They worked until I added a router for my Kindle Fire.

    I used to be able to watch videos on a certain type of site now all say file not found windows vista. I recently added a router for a kindle fire

    original title: streaming videos

    Hello

    ·          Do you mean that you use Internet Explorer 6 in Windows Vista?

    Windows Vista Internet Explorer 7 default features.

    http://Windows.Microsoft.com/en-us/Windows-Vista/find-out-which-version-of-Internet-Explorer-youre-using

  • Unable to connect to Homegroup Windows 7 between the Modem to the PC and the Modem to the router for PC users.

    I want to talk about WIRED computers, do not speak of wireless.

    I have 3 PC:

    -2 are connected via Modem directly to the PC.

    -1 is connected through router, and the router is connected to the modem.

    The problem, this is it, it cannot detect the homegroup that I created on the computer that is directly connected by modem.

    The 2 PC via modem are perfectly detected and connected to the homegroup, so I want to know what I would do to another PC (which is connected to the router via modem) detects the homegroup, I had already created?

    Help, please.

    A Modem can have only two ports, connect to the internet (Wide Area Network) and the second to a SINGLE local device. In most cases the internet Service Pwill provide with only an IP address so itself cannot connect to more than one at a time. In current solutions, it is very rare for a Modem to use. If as you say, you have several devices connected to this unit then he himself is a router but possibly with the Modem built in if you have ADSL ISP.

    If your second unit is also a router then that explains why you cannot connect all devices in the same residential group.

    Router 1 has created a Local Area Network including both PC and the WAN port on the Router 2. Router 2 has created another independent local network with the 3rd PC. It is very likely that the two local networks will be IPv4 and traffic can be routed between them correctly in both directions according to the two local networks subnet ranges.

    Even if they are properly configured to allow traffic that HomeGroup requires IPv6 that some home routers support fully and every Member of the residential group must be on the same LAN anyway, he will not support a routed connection.

    Remove the 3rd PC of the 2nd router and plug it into the direct 1 router, remove the router 2nd the 1st in order to free the port. 3 all PCs are now on the same local network and communicate both IPv4 and IPv6, and homegroup should work.

    If you need additional ports provided by the 2nd router for other devices is not part of this problem then consider replacing it with a switch. If you use Router 2 for other devices Wi - Fi irrelevant then you need a wireless access Point.

  • I want to know what I need to look at when buying a router for 50 concurrent users, 1 server connection information

    Original title: router Question.

    Hi all

    not sure if this is the right place to post but I was looking for some information about routers. specifically, I want to know what I need to look at when buying a router for 50 concurrent users, 1 server connection information. specifications, etc.

    Thanks :)

    Some routers will define a limited number of simultaneous connections. Domestic routers rarely do because the assumption is that the environment will not include such a high number.

    Ideally in a commercial environment you would separate on the hardware connection since the hardware firewall. It depends on the type of connection (ADSL?).

  • Please help to configure the router for internet connection 871W!

    Hello world!

    I just started styding for CCNA, so I'm totally new to Cisco stuff. Recently bought a router 871W and spent two days in a row trying to configure internet connection with no luck! I use the port console for the configs and SDM/CCP. Would be greateful if someone could tell me how to do simple configs of internet connection. I googled everything but it's still confusing. I can't assing all-IP ports FA 0-3. I used instead of the VLAN. But all tutorials use FA0 and when I try to assign an IP address to FA0 it gives me some L2 cannot be assigned or something... :/ And I am also confused at what address IP use for WAN.

    I connected the cable between the Modem and the LAN of the PC port and copied some IP addresses which I think I have to use to configure the router for internet connection. And here they are:

    ISP IP: 76.114.54.255

    SUBNET: 255.255.248.0

    GATEWAY: 76.114.48.1

    DHCP: 69.252.97.4

    DNS: 75.75.75.75

    75.75.76.76

    If you can, please help! Thank you!

    Hi david,

    Looks like your 871w can not get a dynamic IP address: % unknown DHCP problem... No possible allocation

    you could ask your ISP to perform a reset/clear MAC add and try again?

    also, kindly post lastest "show run".

    Edit: just to see you've updated your screenshot. could you add command under 4

    Mac-add 0001.4af9.8b83

Maybe you are looking for