Does anyone know if it's possible to enable SNMP traps to be sent from a Cisco IOS device when an ACL blocks traffic? I'd like to send a trap whenever a deny statement gets a hit.

I've only been able to find information about sending ACL logs to a remote syslog server.


  • I made a minor edit for clarification. At first, I misread the question as "How do I allow SNMP traps from a device's ACL". Feel free to roll-back if I decreased readability.
    – Ryan Foley
    Feb 4 '15 at 13:44
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can post and accept your own answer.
    – Ron Maupin
    Dec 31 '20 at 21:02

So long as the IOS version supports it, you can use extended ACLs to allow the traffic.

Assuming the management IP of the Cisco device is and the trap destination is

Configure SNMP: [Reference]

snmp-server host traps version *version* *community-string*
snmp-server enable traps global configuration

Allow traps through ACL: [Reference]

access-list *access-list-number*
  permit udp 162

Then assign that access list to the management interface:

interface *interface*
  ip access-group *access-list-number* in
  • Thanks! I may have been unclear - I really want the switch to send a trap when it blocks traffic due to an ACL. Is this possible?
    – James
    Feb 4 '15 at 12:14
  • That clears it up...closest I've seen is the snmp-server enable traps firewall, but I don't think that applies to ACLs. I would see if that option is even available on your device.
    – Theo
    Feb 4 '15 at 12:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.