Cisco PIX 525 Specifikace stáhnout pdf (Strana 224)

13-22

Cisco Security Appliance Command Line Configuration Guide

OL-6721-01

Chapter 13 Identifying Traffic with Access Lists

Logging Access List Activity

Configuring Logging for an Access Control Entry

To configure logging for an ACE, see the following information about the log option:

hostname(config)# access-list

access_list_name

[extended]

{deny | permit}

...

[log [[

level

]

[interval

secs

] | disable | default]]

See the “Adding an Extended Access List” section on page 13-9 for complete access-list command

syntax.

If you enter the log option without any arguments, you enable system log message 106100 at the default

level (6) and for the default interval (300 seconds). See the following options:

• level—A severity level between 0 and 7. The default is 6.

• interval secs—The time interval in seconds between system messages, from 1 to 600. The default

is 300. This value is also used as the timeout value for deleting an inactive flow.

• disable—Disables all access list logging.

default—Enables logging to message 106023. This setting is the same as having no log option.

For example, you configure the following access list:

hostname(config)# access-list outside-acl permit ip host 1.1.1.1 any log 7 interval 600

hostname(config)# access-list outside-acl permit ip host 2.2.2.2 any

hostname(config)# access-list outside-acl deny ip any any log 2

hostname(config)# access-group outside-acl in interface outside

When a packet is permitted by the first ACE of outside-acl, the security appliance generates the

following system message:

%PIX-7-106100: access-list outside-acl permitted tcp outside/1.1.1.1(12345) ->

inside/192.168.1.1(1357) hit-cnt 1 (first hit)

Although 20 additional packets for this connection arrive on the outside interface, the traffic does not

have to be checked against the access list, and the hit count does not increase.

If one more connection by the same host is initiated within the specified 10 minute interval (and the

source and destination ports remain the same), then the hit count is incremented by 1 and the following

message is displayed at the end of the 10 minute interval:

%PIX-7-106100: access-list outside-acl permitted tcp outside/1.1.1.1(12345)->

inside/192.168.1.1(1357) hit-cnt 2 (600-second interval)

When a packet is denied by the third ACE, then the security appliance generates the following system

message:

%PIX-2-106100: access-list outside-acl denied ip outside/3.3.3.3(12345) ->

inside/192.168.1.1(1357) hit-cnt 1 (first hit)

20 additional attempts within a 5 minute interval (the default) result in the following message at the end

of 5 minutes:

%PIX-2-106100: access-list outside-acl denied ip outside/3.3.3.3(12345) ->

inside/192.168.1.1(1357) hit-cnt 21 (300-second interval)

1 2 ... 219 220 221 222 223 224 225 226 227 228 229 ... 603 604

Komentáře k této Příručce

Žádné komentáře

Cisco PIX 525 Specifikace Strana 224

Komentáře k této Příručce

Související produkty a manuály pro ne Aeg-Electrolux S70340KA