IP Addresses and Services Configuration Guide for Cisco 8000 Series Routers, IOS XR Releases

PDF

IP Addresses and Services Configuration Guide for Cisco 8000 Series Routers, IOS XR Releases

Interface logging on ACLs

Updated: August 12, 2026

Want to summarize with AI?

This topic describes how interface logging on IPv4 and IPv6 access control lists (ACLs) generates log messages that identify the interface through which traffic enters or exits the router.

You can enable interface logging on IPv4 and IPv6 access control lists (ACLs) so that log messages identify the interface through which traffic enters or exits the router. The router supports two types of interface logging on ACLs:

Ingress interface logging: uses the log-input keyword on ACEs to include, in the log message, the ingress interface on which the router receives the packet. The router supports this feature for both IPv4 and IPv6 ingress ACLs on main interfaces, sub-interfaces, and bridge-group virtual interfaces (BVI).
Egress interface logging: uses the log option on ACEs to identify the packet counts matching the ACEs. With this log option, for egress traffic, you can fetch information such as access list number, packets permitted or denied, and source or destination addresses of the packets.

Table 1. Feature History Table
Feature Name	Release Information	Feature Description
ACL Log Message Collection for Egress Traffic	Release 26.2.1	Introduced in this release on: Modular Systems (8800 [LC ASIC: P100]):* *This feature is supported on: 88-LC1-48Y8H-EM
ACL Log Message Collection for Egress Traffic	Release 25.4.1	Introduced in this release on: Fixed Systems (8010 [ASIC: A100])(select variants only) This feature is supported on: 8011-32Y8L2H2FH 8011-12G12X4Y-A/D
ACL Log Message Collection for Egress Traffic	Release 25.1.1	Introduced in this release on: Fixed Systems (8700 [ASIC: K100], 8010 [ASIC: A100])(select variants only) This feature is supported on: 8011-4G24Y4H-I 8712-MOD-M
ACL Log Message Collection for Egress Traffic	Release 24.4.1	Introduced in this release on: Fixed Systems (8200 [ASIC: P100], 8700 [ASIC: P100])(select variants only); Modular Systems (8800 [LC ASIC: P100])(select variants only) *This feature is supported on: 8212-48FH-M 8711-32FH-M 88-LC1-36EH 88-LC1-12TH24FH-E 88-LC1-52Y8H-EM
ACL Log Message Collection for Egress Traffic	Release 7.10.1	We have made it easier for you to monitor ACL egress traffic, assess traffic load on an ACL, and troubleshoot issues. This is made possible by adding a log option to the ACEs that are associated with an interface and identify the packet counts matching the ACEs. With this log option, for an egress traffic, you can fetch information, such as access list number, packets permitted or denied, and source or destination addresses of the packets.
Enable Ingress Interface Logging on IPv4 and IPv6 ACLs	Release 25.4.1	Introduced in this release on: Fixed Systems (8010 [ASIC: A100])(select variants only) This feature is supported on: 8011-32Y8L2H2FH 8011-12G12X4Y-A/D
Enable Ingress Interface Logging on IPv4 and IPv6 ACLs	Release 25.1.1	Introduced in this release on: Fixed Systems (8700 [ASIC: K100], 8010 [ASIC: A100])(select variants only*) This feature is supported on: 8712-MOD-M 8011-4G24Y4H-I
Enable Ingress Interface Logging on IPv4 and IPv6 ACLs	Release 24.4.1	Introduced in this release on: Fixed Systems (8200 [ASIC: P100], 8700 [ASIC: P100])(select variants only); Modular Systems (8800 [LC ASIC: P100])(select variants only) *This feature is supported on: 8212-48FH-M 8711-32FH-M 88-LC1-36EH 88-LC1-12TH24FH-E 88-LC1-52Y8H-EM
Enable Ingress Interface Logging on IPv4 and IPv6 ACLs	Release 7.8.1	Using the log-input keyword, you can now enable Access Control Lists (ACLs) to generate log messages that help you identify the interface through which a particular traffic stream ingresses the routers. This information aids in optimizing traffic flow across the network. There was no option to enable logging of ingress interfaces with an ACL in earlier releases. This feature introduces an optional keyword log-input for the following commands: deny (IPv4) deny (IPv6) permit (IPv4) permit (IPv6)

Configuration guidelines and limitations for interface logging on ACLs

These guidelines apply for interface logging on ACLs:

The router supports this feature for both IPv4 and IPv6 egress ACLs on main interfaces, sub-interfaces, and bridge-group virtual interfaces (BVI).
This feature is supported only on the Cisco 8000 Series Routers that use Q100 and Q200-based line cards.

Enable ingress interface logging

The log-input option provides the same functionality as the log keyword, except that the log message also includes the ingress interface on which the router receives the packet. The router supports this feature for both IPv4 and IPv6 ingress ACLs on main interfaces, sub-interfaces, and bridge-group virtual interfaces (BVI).

Procedure

Enter global configuration mode.
Example:
```
Router# configure
```

Create an IPv4 access list and add an access control entry (ACE) with the log-input keyword.

Example:

Router(config)# ipv4 access-list test
Router(config-ipv4-acl)# 10 deny udp 10.1.1.0 255.255.255.0 log-input
Router(config-ipv4-acl)# exit

Attach the ACL to an ingress interface by using the ipv4 access-group acl-name ingress command and commit the configuration.
Example:
```
Router(config)# interface FortyGigE0/0/0/22
Router(config-if)# ipv4 access-group test ingress
Router(config-if)# commit
```
Verify ingress interface logging by checking the generated log messages.

The following snippet shows a sample log message when you enable this option on an ACE:
Example:
```
Router: ipv4_acl_mgr[132]: %ACL-IPV4_ACL-6-IPACCESSLOGP : access-list test (10) deny udp
10.1.1.2(0) FortyGigE0/0/0/22-> 10.2.2.2(0), 63782 packets
```
For more information on how to configure IPv4 and IPv6 ACLs, see IPv4 ACLs and IPv6 ACLs.

You have successfully enabled ingress interface logging on the ACL.

Enable egress interface logging

Use this procedure to configure an IPv4 ACL with the log keyword on ACEs and attach it to an egress interface. The log message provides the following information:

access list number
packet permitted or denied
protocol used, such as TCP, UDP, or ICMP
source and destination addresses
source and destination port numbers

Procedure

Enter global configuration mode.
Example:
```
Router# configure
```

Create an IPv4 access list and add access control entries (ACEs) with the log keyword on the entries that you want to log.

Example:

Router(config)# ipv4 access-list test-egress-acl
Router(config-ipv4-acl)# 10 deny tcp host 30.0.10.1 host 30.0.20.1 precedence priority
Router(config-ipv4-acl)# 11 permit tcp 30.0.10.1 0.0.0.255 30.0.20.1 0.0.0.255 dscp af22 log
Router(config-ipv4-acl)# 17 deny udp host 30.0.10.1 host 30.0.20.1 precedence priority log
Router(config-ipv4-acl)# exit

Attach the ACL to an egress interface by using the ipv4 access-group acl-name egress command and commit the configuration.

Example:

Router(config)# interface FourHundredGigE0/1/0/0
Router(config-if)# ipv4 access-group test-egress-acl egress
Router(config-if)# commit

Verify the running configuration of the IPv4 egress ACL and the interface by using the show running-config command.

Example:

Router# show running-config
Wed May  3 16:09:25.917 UTC
ipv4 access-list test-egress-acl
 10 deny tcp host 30.0.10.1 host 30.0.20.1 precedence priority
 11 permit tcp 30.0.10.1 0.0.0.255 30.0.20.1 0.0.0.255 dscp af22 log
17 deny udp host 30.0.10.1 host 30.0.20.1 precedence priority log
!
interface FourHundredGigE0/1/0/0
 mtu 1530
 ipv4 address 30.0.10.2 255.255.255.0
 ipv6 address 130:1::2/96
 ipv4 access-group test-egress-acl egress
!

Verify the packet counts for the filtered egress packets on the interface by using the show access-lists ipv4 acl-name hardware egress location node-id command.

Example:

Router# show access-lists ipv4 test-egress-acl hardware egress location 0/1/CPU0
Wed May  3 16:09:25.917 UTC
ipv4 access-list test-egress-acl
 10 deny tcp host 30.0.10.1 host 30.0.20.1 precedence priority
 11 permit tcp 30.0.10.0 0.0.0.255 30.0.20.0 0.0.0.255 dscp af22 log (1440 matches)
 17 deny udp host 30.0.10.1 host 30.0.20.1 precedence priority log

Verify the ACL logging messages for the egress traffic by using the show logging command.

Example:

Router# show logging | i permit
Wed May  3 16:12:30.162 UTC
Router:May 3 16:09:08.251 UTC: ipv4_acl_mgr[431]: %ACL-IPV4_ACL-6-IPACCESSLOGP : access-list test-egress-acl (11) permit tcp 30.0.10.1(1024) -> 30.0.20.1(1024), 1 packet
Router:May 3 16:10:08.396 UTC: ipv4_acl_mgr[431]: %ACL-IPV4_ACL-6-IPACCESSLOGP : access-list test-egress-acl (11) permit tcp 30.0.10.1(1024) -> 30.0.20.1(1024), 1000 packet

You have successfully enabled egress interface logging on the ACL and verified the packet counts and log messages for the egress traffic.

Need help?

Open a support case

(Requires a Cisco Service Contract)

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.