Yeah finally got that impression from reading.

 

So I have routing turn on.

 

I have 3 access-lists

1) global

! for dns

access-list global_in permit udp any a.b.c.d 255.255.25.255 eq  53

 

2) interface specific one

access-list vlan50_in permit ip 10.132.50.0 255.255.255.0 10.132.40.0 255.255.255.0

 

3) catch all global deny

access-list block_all deny ip any 10.0.0.0 255.0.0.0 log

access-list block_all deny ip any 192.168.0.0 255.255.0.0 log

 

so

interface vlan50

ip access-group global_in in 3

ip access-group vlan50_in 5

ip access-group bloack_all in  30

 

 

That's sort of what I have

 

Comments

1) I can't modify access list with out dropping them and re adding them... argh

2) I can't find where the logged packets go.  I know I have hit the deny line, but they don't get logged in syslog, nor show log

3) I can't list the access list such that I can see how many times a line has been hit, show access list gives me a rather badly thought out representation of the list

 

 

Not being able to see what has been blocked is a game changer...  what does the log tag do ?

 

 

 

Wow thats very limited reporting. you can't tell what caused it to trigger..

do i need this to get it to log

logging monitor informational