Brocade Communications Systems 6650 manual Configuration notes for ACL logging

ACL logging

Brocade(config-vlan-1)# no vlan-dynamic-discovery

Vlan dynamic discovery is disabled

Brocade(config-vlan-1)# interface ethernet 1/1/2

Brocade(config-if-e1000-2)# disable

Brocade(config-if-e1000-2)# interface ve 10

Brocade(config-vif-10)# ip address 192.168.10.254 255.255.255.0

Brocade(config-vif-10)# interface ve 20

Brocade(config-vif-20)# ip access-group test1 in

Brocade(config-vif-20)# ip address 10.15.1.10 255.255.255.0

Brocade(config-vif-20)# exit

Brocade(config)# ip access-list extended test1

Brocade(config-ext-nACL)# permit ip 10.15.1.0 0.0.0.255 any log

Brocade(config-ext-nACL)# permit ip 192.168.10.0 0.0.0.255 any log

Brocade(config-ext-nACL)# end

Brocade#

ACL logging

Brocade devices support ACL logging of inbound packets that are sent to the CPU for processing (denied packets).

NOTE

ACL logging is not supported for outbound packets or any packets that are processed in hardware (permitted packets).

You may want the software to log entries in the syslog for packets that are denied by ACL filters. ACL logging is disabled by default; it must be explicitly enabled on a port.

When you enable logging for ACL entries, statistics for packets that match the deny conditions of the ACL entries are logged. For example, if you configure a standard ACL entry to deny all packets from source address 10.157.22.26, statistics for packets that are explicitly denied by the ACL entry are logged in the Syslog buffer and in SNMP traps sent by the Brocade device.

The first time an ACL entry denies a packet, the software immediately generates a Syslog entry and an SNMP trap. The software also starts a five-minute timer. The timer keeps track of all packets explicitly denied by the ACL entries. After five minutes, the software generates a single Syslog entry for each ACL entry that denied a packet. The Syslog entry (message) indicates the number of packets denied by the ACL entry during the previous five minutes. Note however that packet count may be inaccurate if the packet rate is high and exceeds the CPU processing rate.

If no ACL entries explicitly deny packets during an entire five-minute timer interval, the timer stops. The timer restarts when an ACL entry explicitly denies a packet.

NOTE

The timer for logging packets denied by MAC address filters is a different timer than the ACL logging timer.

Configuration notes for ACL logging

Note the following points before configuring ACL logging:

•ACL logging is supported for denied packets, which are sent to the CPU for logging. ACL logging is not supported for permitted packets.

Brocade ICX 6650 Security Configuration Guide	105
53-1002601-01