Cisco APIC Security Configuration Guide, Release 6.2(x)

PDF

Cisco APIC Security Configuration Guide, Release 6.2(x)

Enable ACL contract permit and deny logging by using the REST API

Updated: April 17, 2026

Want to summarize with AI?

Log in

Enables access control list (ACL) logging for contract subjects that contain permit or deny actions.

In each filter attachment, the @directives attribute enables logging and the @action attribute determines whether the logged traffic is permitted or denied.

Procedure

Send a POST request with an XML payload similar to the following example:

Example:

<vzBrCP dn="uni/tn-Tenant64/brc-C64" name="C64" scope="context">
                        <vzSubj consMatchT="AtleastOne"
                        name="HTTPSsbj"
                        provMatchT="AtleastOne"
                        revFltPorts="yes"
                        rn="subj-HTTPSsbj">
                        <vzRsSubjFiltAtt action="permit"
                        directives="log"
                        forceResolve="yes"
                        priorityOverride="default"
                        rn="rssubjFiltAtt-PerHTTPS"
                        tDn="uni/tn-Tenant64/flt-PerHTTPS"
                        tRn="flt-PerHTTPS"
                        tnVzFilterName="PerHTTPS"/>
                        </vzSubj>
                        <vzSubj consMatchT="AtleastOne"
                        name="httpSbj"
                        provMatchT="AtleastOne"
                        revFltPorts="yes"
                        rn="subj-httpSbj">
                        <vzRsSubjFiltAtt action="deny"
                        directives="log"
                        forceResolve="yes"
                        priorityOverride="default"
                        rn="rssubjFiltAtt-httpFilter"
                        tDn="uni/tn-Tenant64/flt-httpFilter"
                        tRn="flt-httpFilter"
                        tnVzFilterName="httpFilter"/>
                        </vzSubj>
                        <vzSubj consMatchT="AtleastOne"
                        name="subj64"
                        provMatchT="AtleastOne"
                        revFltPorts="yes"
                        rn="subj-subj64">
                        <vzRsSubjFiltAtt action="permit"
                        directives="log"
                        forceResolve="yes"
                        priorityOverride="default"
                        rn="rssubjFiltAtt-icmp"
                        tDn="uni/tn-common/flt-icmp"
                        tRn="flt-icmp"
                        tnVzFilterName="icmp"/>
                        </vzSubj>
                        </vzBrCP>

ACL logging is enabled for the permit and deny actions specified in the payload.