Cisco PIX 525 Spezifikationen PDF herunterladen (Seite 223)

13-21

Cisco Security Appliance Command Line Configuration Guide

OL-6721-01

Chapter 13 Identifying Traffic with Access Lists

Logging Access List Activity

Access List Logging Overview

By default, when traffic is denied by an extended ACE or a Webtype ACE, the security appliance

generates system message 106023 for each denied packet, in the following form:

%PIX-4-106023: Deny

protocol

src [

interface_name

source_address

source_port

] dst

interface_name

dest_address

dest_port

[type {

string

}, code {

code

}] by access_group

acl_id

If the security appliance is attacked, the number of system messages for denied packets can be very large.

We recommend that you instead enable logging using system message 106100, which provides statistics

for each ACE and lets you limit the number of system messages produced. Alternatively, you can disable

all logging.

Note Only ACEs in the access list generate logging messages; the implicit deny at the end of the access list

does not generate a message. If you want all denied traffic to generate messages, add the implicit ACE

manually to the end of the access list, as follows.

hostname(config)# access-list TEST deny ip any any log

The log options at the end of the extended access-list command lets you to set the following behavior:

• Enable message 106100 instead of message 106023

• Disable all logging

• Return to the default logging using message 106023

System message 106100 is in the following form:

%PIX-n-106100: access-list

acl_id

{permitted | denied}

protocol

interface_name

source_address

(

source_port

) ->

interface_name

dest_address

(

dest_port

)

hit-cnt

number

({first hit |

number

-second interval})

When you enable logging for message 106100, if a packet matches an ACE, the security appliance

creates a flow entry to track the number of packets received within a specific interval. The security

appliance generates a system message at the first hit and at the end of each interval, identifying the total

number of hits during the interval. At the end of each interval, the security appliance resets the hit count

to 0. If no packets match the ACE during an interval, the security appliance deletes the flow entry.

A flow is defined by the source and destination IP addresses, protocols, and ports. Because the source

port might differ for a new connection between the same two hosts, you might not see the same flow

increment because a new flow was created for the connection. See the “Managing Deny Flows” section

on page 13-23 to limit the number of logging flows.

Permitted packets that belong to established connections do not need to be checked against access lists;

only the initial packet is logged and included in the hit count. For connectionless protocols, such as

ICMP, all packets are logged even if they are permitted, and all denied packets are logged.

See the Cisco Security Appliance Logging Configuration and System Log Messages for detailed

information about this system message.

1 2 ... 218 219 220 221 222 223 224 225 226 227 228 ... 603 604

Kommentare zu diesen Handbüchern

Keine Kommentare

Cisco PIX 525 Spezifikationen Seite 223

Kommentare zu diesen Handbüchern