Cisco APIC Security Configuration Guide, Release 6.2(x)

PDF

Cisco APIC Security Configuration Guide, Release 6.2(x)

View ACL permit and deny logs by using the NX-OS-style CLI

Updated: April 17, 2026

Want to summarize with AI?

Log in

Displays access control list (ACL) permit and deny logs for Layer 2 and Layer 3 packets and flows.

Before you begin

Enable ACL permit or deny logging and generate traffic that matches the logged rule.

Use the show acllog command to view ACL log entries.

Use the following syntax to view Layer 3 logs:

show acllog {permit | deny} l3 {pkt | flow} tenant tenant_name vrf vrf_name [filters] detail

Layer 3 filters include srcip , dstip , srcport , dstport , protocol , srcintf , start-time , and end-time .

Use the following syntax to view Layer 2 logs:

show acllog {permit | deny} l2 {flow | pkt} tenant tenant_name vrf vrf_name [srcintf source_interface] [vlan vlan_id] detail
Note

The full command syntax is available on Generation 2 and later Cisco Nexus 9000 Series switches with Cisco Application Policy Infrastructure Controller (APIC) Release 3.2 or later. Generation 2 switch model names end in -EX or -FX. On Generation 1 switches or with releases earlier than Cisco APIC Release 3.2, use the supported base command syntax.

On supported switches with Cisco APIC Release 3.2 or later, you can also filter detailed output by using dstEpgName , dstmac , dstpctag , srcEpgName , srcmac , or srcpctag .

Procedure

  1. Display detailed Layer 3 deny flow logs for the common tenant and default VRF.

    This example applies to a Generation 2 or later switch with Cisco APIC Release 3.2 or later.

    Example:

    apic1# show acllog deny l3 flow tenant common vrf default detail

  2. Display detailed Layer 2 deny flow logs for the common tenant and tsw0connctx0 VRF.

    This example applies to a Generation 2 or later switch with Cisco APIC Release 3.2 or later.

    Example:

    apic1# show acllog deny l2 flow tenant common vrf tsw0connctx0 detail

  3. Display detailed Layer 3 permit packet logs for the common tenant and default VRF.

    This example applies to a Generation 1 switch or a release earlier than Cisco APIC Release 3.2.

    Example:

    apic1# show acllog permit l3 pkt tenant common vrf default detail

  4. Display Layer 2 permit packet logs for the common tenant, default VRF, and port-channel5 source interface.

    This example applies to a Generation 1 switch or a release earlier than Cisco APIC Release 3.2.

    Example:

    apic1# show acllog permit l2 pkt tenant common vrf default srcintf port-channel5