| 3.1 |  | Access Control Lists |
| 3.1.7 |  | Troubleshooting |

| Logging ACLs If too much traffic is being denied, study the logic of the ACL, or try defining and applying an additional, broader list. The show ip access-lists command provides a packet count showing which ACL entry is being hit. Using the log keyword at the end of the individual ACL entries shows the ACL number and whether the packet was permitted or denied, in addition to port-specific information . To view the log, use the show logging command. Remember that logging messages can be sent to the local buffer or to a syslog server depending on configuration.

The steps in Figure explain the debug process. Before beginning, be certain to check if any other ACL exists. If other ACLs exist, remove them. Also, ensure that fast switching is disabled . Use extreme caution when debugging a system with heavy traffic. If debugging with an ACL is required, it can be done, but be sure of the process and the traffic flow.

In many cases, network administrators may want to track when traffic is in violation of specified ACLs. This can be easily tracked by defining the deny any statement with the log option.