Thanks for your interest & help. Hopefully this will show you a better picture of the config. The first shows the generic forwarding rule (near the top of the rules list):
The next shows the rules for capturing the NAC messages (quite a ways down the priority list) and logging locally:
