Cisco APIC Security Configuration Guide, Release 6.2(x)

PDF

Cisco APIC Security Configuration Guide, Release 6.2(x)

Enable ACL contract permit logging by using the NX-OS-style CLI

Updated: April 17, 2026

Want to summarize with AI?

Log in

Enables access control list (ACL) logging for packets and flows that contract permit rules allow.

Procedure

  1. Enter the following commands to enable permit logging for a contract subject:

    For direction , enter in , out , or both .

    Example:

    configure
                        tenant tenant_name
                        contract contract_name type permit
                        subject subject_name
                        access-group access_list_name direction log
                        end

    The following example enables permit logging for the icmp subject:

    apic1# configure
                        apic1(config)# tenant BDMode1
                        apic1(config-tenant)# contract Logicmp type permit
                        apic1(config-tenant-contract)# subject icmp
                        apic1(config-tenant-contract-subj)# access-group arp both log
                        apic1(config-tenant-contract-subj)# end

    Permit logging is enabled for traffic that matches the specified access list.

  2. To disable permit logging later, use the no access-group command in contract-subject configuration mode.

    Example:

    apic1# configure
                        apic1(config)# tenant BDMode1
                        apic1(config-tenant)# contract Logicmp type permit
                        apic1(config-tenant-contract)# subject icmp
                        apic1(config-tenant-contract-subj)# no access-group arp both log
                        apic1(config-tenant-contract-subj)# end