Nortel SMC 2450, Implementation Manual

Page: 211 / 262

Logging Page 211 of 260
Secure Multimedia Controller Implementation Guide
Policy-based logging
You can enable or disable logging for each firewall policy. If enabled, all
packets that match that policy generate a log message.
Security Log details
This section contains information about two aspects of using the log: the
concept of self policies, and rule ID mappings. For information about
Security Log details, see “SMC packet filter log messages” on
page 251 .
Self policies
The SMC has multiple levels of protection, such as self policies, for traffic
addressed to itself. Self policies are included in the standard firewall rule
base; these policies cannot be modified. Self policies can trap for certain
messages and then send details to the Security Log.
Rule id mappings
Firewall log messages often map to a specific firewall rule, as defined by a
rule ID listed in the log. An example follows:
Apr 29 20:06:48 172.16.7.225 id=firewall time="2004-04-29
14:49:48" fw= a10-10-10-10 pri=1 proto=6(tcp)
src=172.16.8.226 dst=172.16.7.224 mid=2077 mtp=128
msg="Deny access policy matched, dropping packet Src 45121
Dst 21 from ext n/w" ruleid=23 agent=Firewall
The mapping of rules to log messages is dynamic. Using the Diagnostics >
Applied Rules page in the Web UI, you can map a particular rule ID to the
type of traffic. You can view inbound, outbound, and self rules generated on
this page.
Note: Adding a UNIStim server adds rules to the database as well. These
rules are called autogenerated rules and are displayed in green on the rule
mappings page.