Cisco PIX 525 Especificaciones descargar pdf (Pagina 225)

100

101

13-23

Cisco Security Appliance Command Line Configuration Guide

OL-6721-01

Chapter 13 Identifying Traffic with Access Lists

Logging Access List Activity

Managing Deny Flows

When you enable logging for message 106100, if a packet matches an ACE, the security appliance

creates a flow entry to track the number of packets received within a specific interval. The security

appliance has a maximum of 32 K logging flows for ACEs. A large number of flows can exist

concurrently at any point of time. To prevent unlimited consumption of memory and CPU resources, the

security appliance places a limit on the number of concurrent deny flows; the limit is placed only on deny

flows (and not permit flows) because they can indicate an attack. When the limit is reached, the security

appliance does not create a new deny flow for logging until the existing flows expire.

For example, if someone initiates a DoS attack, the security appliance can create a large number of deny

flows in a short period of time. Restricting the number of deny flows prevents unlimited consumption of

memory and CPU resources.

When you reach the maximum number of deny flows, the security appliance issues system message

106100:

%PIX-1-106101: The number of ACL log deny-flows has reached limit

(numbe

r).

To configure the maximum number of deny flows and to set the interval between deny flow alert

messages (106101), enter the following commands:

• To set the maximum number of deny flows permitted per context before the security appliance stops

logging, enter the following command:

hostname(config)# access-list deny-flow-max

number

The number is between 1 and 4096. 4096 is the default.

• To set the amount of time between system messages (number 106101) that identify that the

maximum number of deny flows was reached, enter the following command:

hostname(config)# access-list alert-interval

secs

The seconds are between 1 and 3600. 300 is the default.

1 2 ... 220 221 222 223 224 225 226 227 228 229 230 ... 603 604

Comentarios a estos manuales

Sin comentarios

Cisco PIX 525 Especificaciones Pagina 225

Comentarios a estos manuales