Cisco PIX 525 Dokumentacja Pobierz pdf (Strona 342)

9-40

Cisco PIX Firewall and VPN Configuration Guide

78-15033-01

Chapter 9 Accessing and Monitoring PIX Firewall

Using Syslog

Table 9-7 summarizes the commands that you can use to determine the messages that are displayed.

Ta b l e 9-7 Commands to Control Syslog Messages

Command Effect

ip audit signature signature_number disable

Attaches a global policy to a signature. Used to

disable or exclude a signature from auditing.

no ip audit signature signature_number

Removes the policy from a signature. Used to

reenable a signature.

show ip audit signature [signature_number]

Displays disabled signatures.

ip audit info [action [alarm] [drop] [reset]]

Specifies the default action to be taken for

signatures classified as informational signatures.

The alarm option indicates that when a signature

match is detected in a packet, PIX

Firewall reports

the event to all configured syslog servers. The

drop option drops the offending packet. The reset

option drops the offending packet and closes the

connection if it is part of an active connection. The

default is alarm. To cancel event reactions,

specify the ip audit info command without an

action option.

no ip audit info

Sets the action to be taken for signatures classified

as informational and reconnaissance to the default

action.

show ip audit info

Displays the default informational actions.

ip audit attack [action [alarm] [drop]

[

reset]]

Specifies the default actions to be taken for attack

signatures. The action options are as previously

described.

no ip audit attack

Sets the action to be taken for attack signatures to

the default action.

show ip audit attack

Displays the default attack actions. An audit

policy (audit rule) defines the attributes for all

signatures that can be applied to an interface along

with a set of actions. Using an audit policy the user

may limit the traffic that is audited or specify

actions to be taken when the signature matches.

Each audit policy is identified by a name and can

be defined for informational or attack signatures.

Each interface can have two policies; one for

informational signatures and one for attack

signatures. If a policy is defined without actions,

then the configured default actions will take effect.

Each policy requires a different name.

ip audit name audit_name info [action

[

alarm] [drop] [reset]]

All informational signatures except those disabled

or excluded by the ip audit signature command

are considered part of the policy. The actions are

the same as described previously.

no ip audit name audit_name [info]

Remove the audit policy audit_name.

1 2 ... 337 338 339 340 341 342 343 344 345 346 347 ... 465 466

Komentarze do niniejszej Instrukcji

Brak uwag

Cisco PIX 525 Dokumentacja Strona 342

Komentarze do niniejszej Instrukcji

Powiązane produkty i podręczniki dla Systemy kontroli dostępu bezpieczeństwa Cisco PIX 525