Cisco PIX 525 Especificaciones descargar pdf (Pagina 340)

9-38

Cisco PIX Firewall and VPN Configuration Guide

78-15033-01

Chapter 9 Accessing and Monitoring PIX Firewall

Using Syslog

Deny Example

1. An inbound TCP packet (3.3.3.3/12345 -> 192.168.1.1/1357) arrives on the outside interface.

2. The packet is permitted by the first ACE of the outside-acl access list, which has the log option

enabled with log level 2.

3. The log flow (TCP, 3.3.3.3, 12345, 192.168.1.1, 1357) has not be cached, so the following syslog

message is generated and the log flow is cached.

106100: access-list outside-acl denied tcp outside/3.3.3.3(12345) ->

inside/192.168.1.1(1357) hit-cnt 1 (first hit)

4. Twenty matching packets arrive on the outside interface within the next five minutes (300 seconds).

Because the log flow has been cached, the hit count is incremented for each packet.

5. At the end of fifth minute, the following syslog message is generated and the hit count for the log

flow is reset to 0.

106100: access-list outside-acl permitted tcp outside/3.3.3.3(12345)->

inside/192.168.1.1(1357) hit-cnt 20 (300-second interval)

6. No matching packets arrive on the outside interface within the next five minutes, so the hit count for

the log flow remains at 0.

7. At the end of tenth minute, the cached flow (TCP, 3.3.3.3, 12345, 192.168.1.1, 1357) is deleted

because the hit count remains at 0.

No Log Example

Packets arriving on the outside interface from 2.2.2.2 to 192.168.1.1 are permitted by the 2nd ACE of

outside-acl but they do not trigger any logging because the log option is not enabled for the ACE.

Syslog Message Format

The following is the new syslog format used by messages generated for an ACL entry:

106100: access-list <acl_id> <grant> <prot> <intf/src_ip(src_port)> ->

<intf/dst_ip(dest_port)> hit-cnt <nnn> (first hit|n-second interval)

Table 9-5 describes the meaning of each field in this message format.

Ta b l e 9-5 Syslog Message Format for ACL Logging

Field Description

<grant Displays if the flow is permitted or denied.

<prot> Displays the protocol type: tcp, udp, icmp, or an IP protocol number.

<intf> Displays the interface name (as configured by the nameif command) for the

source or destination of the logged flow. This can include logical (VLAN)

interfaces.

<src_ip> Displays the source IP address of the logged flow.

<dst_ip> Displays the destination IP address of the logged flow.

<src_port> Displays the source port of the logged flow (tcp or udp). For ICMP, this field

is 0.

<dst_port> Displays the destination port of the logged flow (tcp or udp). For ICMP, this

field is icmp-type.

1 2 ... 335 336 337 338 339 340 341 342 343 344 345 ... 465 466

Comentarios a estos manuales

Sin comentarios

Cisco PIX 525 Especificaciones Pagina 340

Comentarios a estos manuales

Relacionado con productos y manuales para Los Sistemas De Control De Acceso De Seguridad Cisco PIX 525