0 bites on Cisco Communities, posting here as well: DACL Logging in ISE

Hello all,

   Has anybody successfully used 'log' at the end of their ACEs within a DACL?

   We've been running dot1x for quite some time now. I'm beginning to alter my policies to push a 'permit ip any any log' dacl to specific hosts. I'm finding that on almost every switch in our environment, no logging is sent to the switch's log buffer for hits on that dacl.

   The exception, is a 4500 (Sup 7L-E) running v03.06.08.E. This behavior is not listed in any release notes as new functionality, and I cannot find when it became a supported feature. I've opened a TAC case, and there's an associated bug ID (CSCvj79680). I've also come across a community post from 2 years ago with the same issue: https://community.cisco.com/t5/policy-and-access/dacl-logging-in-ise/td-p/2894112

   Just looking for any information out there I may not know about. Also trying to get a little more traction behind this issue in hopes it'll get on dev road maps to fix. The more we actively work to push DACLs, the more limitations we've found along the way.

Example output from the aforementioned 4500 switch:

729008: Jul 19 13:27:12.393 EDT: %SEC-6-IPACCESSLOGP: list NACL_xACSACLx-IP-mersive_dacl-5b3ba851 denied udp 172.16.60.22(1312) -> 8.8.8.8(53), 1 packet

729009: Jul 19 13:28:11.953 EDT: %SEC-6-IPACCESSLOGP: list NACL_xACSACLx-IP-mersive_dacl-5b3ba851 denied udp 172.16.60.22(24296) -> 8.8.8.8(53), 1 packet

729010: Jul 19 13:28:21.959 EDT: %SEC-6-IPACCESSLOGP: list NACL_xACSACLx-IP-mersive_dacl-5b3ba851 denied udp 172.16.60.22(55324) -> 8.8.8.8(53), 1 packet

729011: Jul 19 13:30:12.392 EDT: %SEC-6-IPACCESSLOGP: list NACL_xACSACLx-IP-mersive_dacl-5b3ba851 denied udp 172.16.60.22(7806) -> 8.8.8.8(53), 1 packet