Cisco PIX 525 Dokumentacja Pobierz pdf (Strona 338)

9-36

Cisco PIX Firewall and VPN Configuration Guide

78-15033-01

Chapter 9 Accessing and Monitoring PIX Firewall

Using Syslog

To enable logging of the number of permits or denies of a flow by an ACL entry during a specific period

of time, use the following command:

access-list acl_id [ log [ disable|default] | [level] [interval seconds] ]

Use the disable option to completely disable the log option, including syslog message 106023. Use the

default option to restore the default ACL logging behavior, which is to generate syslog message 106023

if a packet is denied.

Replace level with a numeric identifier that sets the severity level to assign to the ACL log messages. If

no level is specified, the default level is 6 (informational).

Replace seconds with the time interval in seconds (1 - 600) after which the system generates an ACL

logging message. This also serves as the timeout value for deleting an inactive flow. If no interval is

specified, the default is 300 seconds.

For example, to apply the logging option to implicitly denied traffic, enter the following command:

access-list acl_id deny ip any any [log .... ]

If the same command is repeated but with different values for level or interval, the new values will be in

effect for the subsequent new flows. Existing flows will not be affected, however.

To specify the maximum number of concurrent deny-flows that can be created, enter the following

command:

access-list deny-flow-max num_of_flows

The deny-flow-max keyword specifies the maximum number of concurrent deny-flows that can be

created. New values for this option go into effect immediately.

The default is set for the maximum number of flows allowed, which depends on the amount of memory

available on the PIX

Firewall, as follows:

• 64 MB or greater—Maximum value/default value is 4096

• 16 MB or greater—Maximum value/default value is 1024

• Less than 16 MB—Maximum value/default value is 256

When the maximum number of flows has been reached, a syslog message (106101) is generated. By

default, this message is repeated once every 300 seconds. To change this interval, enter the following

command:

access-list alert-interval secs

Replace secs with the number of seconds you want the system to wait before generating another

message.

To disable the log option without having to remove the access control entry, use the disable keyword.

For example:

access-list aclid deny ip any any log disable

When you use the no access-list command to remove an ACE with the log option enabled, it is not

necessary to specify all the log options. Removing an ACE with the log option enabled does not remove

any cached flows associated with the ACE. However, removing the ACL removes all cached flows

associated with the ACL.

Use the show access-list command to display the total number of cached ACL log flows, the number of

cached deny-flows, and the maximum number of allowed deny-flows. The clear access-list command

removes all the cached flows.

1 2 ... 333 334 335 336 337 338 339 340 341 342 343 ... 465 466

Komentarze do niniejszej Instrukcji

Brak uwag

Cisco PIX 525 Dokumentacja Strona 338

Komentarze do niniejszej Instrukcji

Powiązane produkty i podręczniki dla Systemy kontroli dostępu bezpieczeństwa Cisco PIX 525