35-11
Cisco 7600 Series Router Cisco IOS Software Configuration Guide, Release 12.2SX
OL-4266-08
Chapter 35 Configuring VLAN ACLs
Configuring VACL Logging
Configuring VACL Logging
When you configure VACL logging, IP packets that are denied generate log messages in these situations:
• When the first matching packet is received
• For any matching packets received during the last 5-minute interval
• If the threshold is reached before the 5-minute interval
Log messages are generated on a per-flow basis. A flow is defined as packets with the same IP addresses and
Layer 4 (UDP or TCP) port numbers.
When a log message is generated, the timer and packet count is reset.
These restrictions apply to VACL logging:
• Because of the rate-limiting function for redirected packets, VACL logging counters may not be
accurate.
• Only denied IP packets are logged.
To configure VACL logging, use the action drop log command action in VLAN access map submode
(see the “Configuring VACLs” section on page 35-4 for configuration information) and perform this task
in global configuration mode to specify the global VACL logging parameters:
This example shows how to configure global VACL logging in hardware:
Router(config)# vlan access-log maxflow 800
Router(config)# vlan access-log ratelimit 2200
Router(config)# vlan access-log threshold 4000
Command Purpose
Step 1
Router(config)# vlan access-log maxflow
max_number
Sets the log table size. The content of the log table can be
deleted by setting the maxflow number to 0. The default
is 500 with a valid range of 0 to 2048. When the log table
is full, logged packets from new flows are dropped by the
software.
Step 2
Router(config)# vlan access-log ratelimit
pps
Sets the maximum redirect VACL logging packet rate.
The default packet rate is 2000 packets per second with a
valid range of 0 to 5000. Packets exceeding the limit are
dropped by the hardware.
Step 3
Router(config)# vlan access-log threshold
pkt_count
Sets the logging threshold. A logging message is generated
if the threshold for a flow is reached before the 5-minute
interval. By default, no threshold is set.
Step 4
Router(config)# exit
Exits VLAN access map configuration mode.
Step 5
Router# show vlan access-log config
(Optional) Displays the configured VACL logging
properties.
Step 6
Router# show vlan access-log flow
protocol
{{
src_addr src_mask
} | any | {host {
hostname
|
host_ip
}}} {{
dst_addr dst_mask
} | any | {host
{
hostname
|
host_ip
}}}
[vlan
vlan_id
]
(Optional) Displays the content of the VACL log table.
Step 7
Router# show vlan access-log statistics
(Optional) Displays packet and message counts and other
statistics.
To Next Page
Loading...
Need help?
General
