Lenovo ThinkSystem NE2552E, Application Manual

Page: 127 / 574

© Copyright Lenovo 2018 Chapter 7: Access Control Lists
127
ACL Port Mirroring
For regular ACLs and VMaps, packets that match an ACL on a specific port can be
mirrored to another switch port for network diagnosis and monitoring.
The source port for the mirrored packets cannot be a portchannel, but may be a
member of a portchannel.
The destination port to which packets are mirrored must be a physical port.
If the ACL has an action (permit, drop etc.) assigned, it cannot be used to mirror
packets for that ACL.
Use the following commands to add mirroring to an ACL:
 For regular ACLs:
The ACL must be also assigned to it target ports as usual (see “Assigning
Individual ACLs to a Port” on page 124 , or “Assigning ACL Groups to a Port” on
page 125 ).
Viewing ACL Statistics
ACL statistics display how many packets have “hit” (matched) each ACL. Use
ACL statistics to check filter performance or to debug the ACL filter configuration.
You must enable statistics for each ACL that you wish to monitor:
ACL Logging
ACLs are generally used to enhance port security. Traffic that matches the
characteristics (source addresses, destination addresses, packet type, etc.) specified
by the ACLs on specific ports is subject to the actions (chiefly permit or deny)
defined by those ACLs. Although switch statistics show the number of times
particular ACLs are matched, the ACL logging feature can provide additional
insight into actual traffic patterns on the switch, providing packet details in the
system log for network debugging or security purposes.
Enabling ACL Logging
By default, ACL logging is disabled. Enable or disable ACL logging on a per ‐ ACL
basis as follows:
NE2552E(config)# access-control list
<ACL number>
mirror port
<destination
port>
NE2552E(config)# access-control list
<ACL number>
statistics
NE2552E(config)# [ no ] access-control list
<IPv4 ACL number>
log
NE2552E(config)# [ no ] access-control list6
<IPv6 ACL number>
log