Filter
Top Products
570 PowerConnect B-Series FCX Configuration Guide
53-1002266-01
Enabling ACL logging
16
PowerConnect(config-vif-10)#int ve 20
PowerConnect(config-vif-20)#ip access-group test1 in
PowerConnect(config-vif-20)#ip address 10.15.1.10 255.255.255.0
PowerConnect(config-vif-20)#exit
PowerConnect(config)#ip access-list extended test1
PowerConnect(config-ext-nACL)#permit ip 10.15.1.0 0.0.0.255 any log
PowerConnect(config-ext-nACL)#permit ip 192.168.10.0 0.0.0.255 any log
PowerConnect(config-ext-nACL)#end
PowerConnect#
Enabling ACL logging
You may want the software to log entries in the Syslog for packets that are denied by ACL filters.
ACL logging is disabled by default; it must be explicitly enabled on a port.
When you enable logging for ACL entries, statistics for packets that match the deny conditions of
the ACL entries are logged. For example, if you configure a standard ACL entry to deny all packets
from source address 209.157.22.26, statistics for packets that are explicitly denied by the ACL
entry are logged in the Syslog buffer and in SNMP traps sent by the Brocade device.
The first time an ACL entry denies a packet, the software immediately generates a Syslog entry and
an SNMP trap. The software also starts a five-minute timer. The timer keeps track of all packets
explicitly denied by the ACL entries. After five minutes, the software generates a single Syslog entry
for each ACL entry that denied a packet. The Syslog entry (message) indicates the number of
packets denied by the ACL entry during the previous five minutes. Note however that packet count
may be inaccurate if the packet rate is high and exceeds the CPU processing rate.
If no ACL entries explicitly deny packets during an entire five-minute timer interval, the timer stops.
The timer restarts when an ACL entry explicitly denies a packet.
NOTE
The timer for logging packets denied by MAC address filters is a different timer than the ACL logging
timer.
Configuration notes
Note the following before configuring ACL logging:
• ACL logging is supported for denied packets, which are sent to the CPU for logging. ACL logging
is not supported for permitted packets.
• ACL logging is not supported for dynamic ACLs with multi-device port authentication and
802.1X.
• Packets that are denied by ACL filters are logged in the Syslog based on a sample time-period.
• You can enable ACL logging on physical and virtual interfaces.
• When ACL logging is disabled, packets that match the ACL rule are forwarded or dropped in
hardware.
• ACL logging is supported on PowerConnect B-Series FCX devices for ACLs that are applied to
network management access features such as Telnet, SSH, Web, and SNMP.
PowerConnect(config)#traffic-policy TPD1 rate-limit fixed 100 exceed-action
drop
PowerConnect(config)#access-list 101 deny ip host 210.10.12.2 any
traffic-policy TPD1 log