Cisco APIC Security Configuration Guide, Release 6.2(x)

PDF

Cisco APIC Security Configuration Guide, Release 6.2(x)

Enable taboo contract deny logging by using the NX-OS-style CLI

Updated: April 17, 2026

Want to summarize with AI?

Log in

Enables access control list (ACL) logging for packets and flows that taboo contract rules deny.

Procedure

  1. Enter the following commands to enable deny logging for a taboo contract subject:

    Example:

    configure
                        tenant tenant_name
                        contract contract_name type deny
                        subject subject_name
                        access-group access_list_name both log
                        end

    The following example enables deny logging for the dropftp subject:

    apic1# configure
                        apic1(config)# tenant BDMode1
                        apic1(config-tenant)# contract dropFTP type deny
                        apic1(config-tenant-contract)# subject dropftp
                        apic1(config-tenant-contract-subj)# access-group ftp both log
                        apic1(config-tenant-contract-subj)# end

    Deny logging is enabled for traffic that matches the specified access list.

  2. To disable deny logging later, use the no access-group command in contract-subject configuration mode.

    Example:

    apic1# configure
                        apic1(config)# tenant BDMode1
                        apic1(config-tenant)# contract dropFTP type deny
                        apic1(config-tenant-contract)# subject dropftp
                        apic1(config-tenant-contract-subj)# no access-group ftp both log
                        apic1(config-tenant-contract-subj)# end