Cisco PIX 525 Spezifikationen PDF herunterladen (Seite 337)

9-35

Cisco PIX Firewall and VPN Configuration Guide

78-15033-01

Chapter 9 Accessing and Monitoring PIX Firewall

Using Syslog

To view disabled messages, enter the following command:

show logging disabled

To view all messages with modified levels, and all disabled messages, enter the following command:

show logging message

Logging Access Control List Activity

This section describes a logging option, introduced with PIX Firewall Version 6.3, that lets you log the

number of permits or denies of a flow by an ACL entry during a specific period of time. It includes the

following topics:

• Overview, page 9-35

• Configuration, page 9-35

• Logging Behavior, page 9-37

• Syslog Message Format, page 9-38

Overview

When logging is enabled for specific ACL activity, statistics are provided for each flow. A flow is defined

by protocol, source IP address, source port, destination IP address, and destination port. The statistics

include the number of permits or denies of the flow by an ACL entry during the specified time interval.

When a flow is permitted or denied, the system checks to see if the flow already exists in the system. If

not, an initial syslog message with a hit-count of 1 for the flow is generated. The flow entry is then

created and the hit-count for the flow is incremented every time the flow is permitted or denied.

For an existing flow, a syslog message is generated at the end of each configurable interval to report the

non-zero hit-count for the flow in the current interval. After the syslog message is generated, the

hit-count for the flow is reset to 0 for the next interval. If there is no hit recorded during the interval, the

flow is deleted and no syslog message is generated.

There may exist a large number of flows concurrently at any point of time. To prevent unlimited

consumption of memory and CPU resources, a limit is placed on the number of concurrent deny-flows.

When the limit is reached, no new deny-flow will be created until the existing deny-flows expire.

If the new logging option is not configured on an ACL that is used in an access-group command, the

older logging scheme (syslog 106023 for denied flows) remains in effect.

Configuration

Logging of specific ACL activity only applies to ACLs configured using the access-group command, so

only traffic through the PIX

Firewall is subject to logging. Also, ACLs used with selectors such as the

aaa authen match command have no logging effect.

Caution Exercise caution when enabling this option because a very large number of syslog messages may be

generated in a short period of time in the event of a denial of service (DoS) attack.

1 2 ... 332 333 334 335 336 337 338 339 340 341 342 ... 465 466

Keine Kommentare

Cisco PIX 525 Spezifikationen Seite 337