Purpose
Command or Action
Specifies the minimum severity level to log ACL
matches. The default is 6 (informational). The range is
from 0 (emergency) to 7 (debugging).
acllog match-log-level severity-level
Example:
switch(config)# acllog
match-log-level 5
Step 13
(Optional)
Displays information on the active logged flows, such
as source IP and destination IP addresses, source port
show logging ip access-list cache
[
detail
]
Example:
switch(config)# show logging ip
access-list cache
Step 14
and destination port information, source interfaces, and
so on. If you entered the
logging ip access-list detailed
command, the output also includes the ACL name, the
sequence number of ACE, action, ACL direction, ACL
filter type, and the ACL applied interface .
Changing an IP ACL
You can add and remove rules in an existing IPv4 or IPv6 ACL. You cannot change existing rules. Instead,
to change a rule, you can remove it and recreate it with the desired changes.
If you need to add more rules between existing rules than the current sequence numbering allows, you can
use the
resequence
command to reassign sequence numbers.
Procedure
Purpose
Command or Action
Enters global configuration mode.
switch#
configure terminal
Step 1
Enters IP ACL configuration mode for the ACL that you
specify by name.
switch(config)# {
ip
|
ipv6
}
ip
access-list name
Step 2
Enters IP ACL configuration mode for the ACL that you
specify by name.
switch(config)#
ip access-list name
Step 3
Creates a rule in the IP ACL. Using a sequence number
allows you to specify a position for the rule in the ACL.
switch(config-acl)#
[
sequence-number
] {
permit
|
deny
}
protocol source destination
Step 4
Without a sequence number, the rule is added to the end
of the rules. The
sequence-number
argument can be a
whole number between 1 and 4294967295.
The
permit
and
deny
commands support many ways of
identifying traffic. For more information, see the
Command
Reference
for your Cisco Nexus device.
(Optional)
Removes the rule that you specified from the IP ACL.
switch(config-acl)#
no
{
sequence-number
| {
permit
|
deny
}
protocol source destination
}
Step 5
Cisco Nexus 3600 NX-OS Security Configuration Guide, Release 7.x
84
Configuring IP ACLs
Changing an IP ACL
