Cisco APIC Security Configuration Guide, Release 6.2(x)

PDF

Cisco APIC Security Configuration Guide, Release 6.2(x)

Enable ACL contract permit or deny logging by using the GUI

Updated: April 17, 2026

Want to summarize with AI?

Log in

Enables access control list (ACL) logging for flows and packets that a contract subject permits or denies.

Note

For permit logging, configure the contract in the tenant that contains the VRF associated with the endpoint group (EPG). This tenant might differ from the tenant that contains the EPG or its associated contracts.

Procedure

  1. On the menu bar, choose Tenants > tenant_name .

  2. In the Navigation pane, expand Contracts , right-click Standard , and choose Create Contract .

  3. In the Create Contract dialog box, configure the contract.

    1. In the Name field, enter a name for the contract.
    2. In the Scope field, choose VRF , Tenant , or Global .
    3. Optional: Configure the target differentiated services code point (DSCP) or quality of service (QoS) class for the contract.
    4. Next to Subjects , click + .

  4. In the Create Contract Subject dialog box, configure the contract subject.

    1. In the Name field, enter a name for the subject.
    2. Optional: In the Description field, enter a description.
    3. Optional: From the Target DSCP drop-down list, choose the DSCP value to apply to the subject.
    4. Keep Apply Both Directions selected to apply the contract in both directions. Clear the option to apply the contract only from the consumer to the provider.
    5. If Apply Both Directions is selected, keep Reverse Filter Ports selected to exchange the Layer 4 source and destination ports for provider-to-consumer traffic.
    6. Next to Filters , click + .
    7. From the Name drop-down list, choose a filter, such as arp , default , est , or icmp .
    8. From the Directives drop-down list, choose log .
    9. For Action , retain the default value of Permit to enable permit logging, or choose Deny to enable deny logging.

      With the log directive enabled, the selected action determines whether the ACL logs record traffic that the subject permits or denies.

    10. Optional: Set the priority for the subject.
    11. Click Update .

  5. In the Create Contract Subject dialog box, click OK .

  6. Click Submit .

    Permit or deny logging is enabled for the selected contract filter.