When SGACL logging is enabled, ICMP Request messages from the device to the client are not logged for IPv4 and IPv6 protocols. However; ICMP Response messages from the client to the device are logged. The following is a sample log, displaying source and destination SGTs, ACE matches (for a permit or deny action), and the protocol, that is, TCP, UDP, IGMP, and ICMP information: *Jun 2 08:58:06.489: %C4K_IOSINTF-6-SGACLHIT:
list deny_udp_src_port_log-30 Denied udp 24.0.0.23(100) -> 28.0.0.91(100), SGT8 DGT 12 In addition to the existing ‘per cell’ SGACL statistics, which can be displayed using the show cts role-based counters command, you can also display ACE statistics, by using the show ip access-list sgacl_name command. No additional configuration is required for this. The following example shows how you can use the show ip access-list command to display the ACE count:
Device# show ip access-control deny_udp_src_port_log-30 Role-based IP access list deny_udp_src_port_log-30 (downloaded) 10 deny udp src eq 100 log (283 matches) 20 permit ip log (50 matches) Note When the incoming traffic matches the cell, but does not match the SGACL of the cell, the traffic is allowed and the counters are incremented in the HW-Permit for the cell. The following example shows how the SGACL of a cell works: The SGACL policy is configured from 5 to 18 with “deny icmp echo” and there is incoming traffic from 5 to 18 with TCP header.
If the cell matches from 5 to 18 but traffic does not match with icmp, traffic will be allowed and HW-Permit counter of cell 5 to 18 will get incremented. Device# show cts role-based permissions from 5 to 18 IPv4 Role-based permissions from group 5:sgt_5_Contractors to group 18:sgt_18_data_user2:sgacl_5_18-01 RBACL Monitor All for Dynamic Policies : FALSE RBACL Monitor All for Configured Policies :
FALSE Device# show ip access-lists sgacl_5_18-01 Role-based IP access list sgacl_5_18-01 (downloaded) 10 deny icmp echo log (1 match) Device# show cts role-based counters from 5 to 18 Role-based IPv4 counters From To SW-Denied HW-Denied SW-Permitt HW-Permitt SW-Monitor HW-Monitor 5 18 0 0 0 1673202 0 0 VRF-aware SGACL Logging The SGACL system logs will include VRF information. In addition to the fields that are currently logged, the logging information will include the VRF name. The updated logging information will be as shown below: *Nov 15 02:18:52.187: %RBM-6-SGACLHIT_V6:
ingress_interface='GigabitEthernet1/0/15' sgacl_name='IPV6_TCP_DENY' action='Deny' protocol='tcp' src-vrf='CTS-VRF' src-ip='25::2' src-port='20' dest-vrf='CTS-VRF' dest-ip='49::2' dest-port='30' sgt='200' dgt='500' logging_interval_hits='1' Cisco TrustSec Overview VRF-aware SGACL Logging Cisco TrustSec Overview 13