552
BigIron RX Series Configuration Guide
53-1001810-01
Applying ACLs to interfaces
21
NOTE
Applying an ACL to a subset of physical interfaces under a virtual routing interface multiplies the
amount of CAM used by the number of physical interfaces specified. An ACL that successfully
functions over a whole virtual routing interface may fail if you attempt to apply it to a subset of
physical interfaces.
To apply an ACL to a subset of ports within a virtual interface, enter commands such as the
following.
BigIron RX
(config)# vlan 10 name IP-subnet-vlan
BigIron RX
(config-vlan-10)# untag ethernet 1/1 to 2/12
BigIron RX
(config-vlan-10)# router-interface ve 1
BigIron RX
(config-vlan-10)# exit
BigIron RX
(config)# access-list 1 deny host 209.157.22.26 log
BigIron RX
(config)# access-list 1 deny 209.157.29.12 log
BigIron RX
(config)# access-list 1 deny host IPHost1 log
BigIron RX
(config)# access-list 1 permit any
BigIron RX
(config)# interface ve 1
BigIron RX
(config-vif-1)# ip access-group 1 in ethernet 1/1 ethernet 1/3 ethernet
2/1 to 2/4
The commands in this example configure port-based VLAN 10, add ports 1/1 – 2/12 to the VLAN,
and add virtual routing interface 1 to the VLAN. The commands following the VLAN configuration
commands configure ACL 1. Finally, the last two commands apply ACL 1 to a subset of the ports
associated with virtual interface 1.
Syntax: [no] ip access-group
<num>
in ethernet
<slot>
/
<portnum>
[
<slot>
/
<portnum>
...] to
<slot>
/
<portnum>
NOTE
The timer for logging packets denied by Layer 2 filters is separate.
Configuring the Layer 4 session log timer
You can configure the Layer 4 session log timer, which tracks packets explicitly denied by an ACL.
The first time an ACL entry denies a packet, the software immediately generates a Syslog entry and
SNMP trap. The software also starts the Layer 4 session log timer. When the timer expires, the
software generates a single Syslog entry for each ACL entry that has denied a packet. The message
indicates the number of packets denied by the ACL entry from the time that the timer was started.
If no ACL entries explicitly deny packets during an entire timer interval, the timer stops. The timer
restarts when an ACL entry explicitly denies a packet.
For example, to set the timer interval to 2 minutes, enter the following command.
BigIron RX
(config)# ip access-list logging-age 2
Syntax: ip access-list logging-age
<minutes>
You can set the timer to between 1 and 10 minutes. The default is 5 minutes.
Displaying ACL log entries
The first time an entry in an ACL denies a packet and logging is enabled for that entry, the software
generates a Syslog message and an SNMP trap. Messages for packets denied by ACLs are at the
warning level of the Syslog.
Содержание Brocade DCX
Страница 40: ...xl BigIron RX Series Configuration Guide 53 1001810 01 ...
Страница 72: ...lxxii BigIron RX Series Configuration Guide 53 1001810 01 ...
Страница 88: ...16 BigIron RX Series Configuration Guide 53 1001810 01 Searching and filtering output 1 ...
Страница 300: ...228 BigIron RX Series Configuration Guide 53 1001810 01 Displaying IP information 7 ...
Страница 318: ...246 BigIron RX Series Configuration Guide 53 1001810 01 Deploying a LAG 8 ...
Страница 418: ...346 BigIron RX Series Configuration Guide 53 1001810 01 SuperSpan 12 ...
Страница 482: ...410 BigIron RX Series Configuration Guide 53 1001810 01 MRP CLI example 14 ...
Страница 506: ...434 BigIron RX Series Configuration Guide 53 1001810 01 Displaying VSRP information 15 ...
Страница 566: ...494 BigIron RX Series Configuration Guide 53 1001810 01 QoS for the oversubscribed 16 x 10GE modules 18 ...
Страница 582: ...510 BigIron RX Series Configuration Guide 53 1001810 01 Viewing Layer 2 ACLs 20 ...
Страница 634: ...562 BigIron RX Series Configuration Guide 53 1001810 01 Troubleshooting ACLs 21 ...
Страница 642: ...570 BigIron RX Series Configuration Guide 53 1001810 01 Trunk formation 22 ...
Страница 746: ...674 BigIron RX Series Configuration Guide 53 1001810 01 Displaying RIP filters 24 ...
Страница 808: ...736 BigIron RX Series Configuration Guide 53 1001810 01 Displaying OSPF information 25 ...
Страница 926: ...854 BigIron RX Series Configuration Guide 53 1001810 01 Generalized TTL security mechanism support 26 ...
Страница 938: ...866 BigIron RX Series Configuration Guide 53 1001810 01 Displaying MBGP information 27 ...
Страница 950: ...878 BigIron RX Series Configuration Guide 53 1001810 01 Using secure copy 28 ...
Страница 988: ...916 BigIron RX Series Configuration Guide 53 1001810 01 Clearing IS IS information 29 ...
Страница 998: ...926 BigIron RX Series Configuration Guide 53 1001810 01 Configuring BFD for the specified protocol 30 ...
Страница 1014: ...942 BigIron RX Series Configuration Guide 53 1001810 01 Displaying multi device port authentication information 31 ...
Страница 1054: ...982 BigIron RX Series Configuration Guide 53 1001810 01 Sample 802 1x configurations 33 ...
Страница 1072: ...1000 BigIron RX Series Configuration Guide 53 1001810 01 IP source guard 35 Syntax show ip source guard ethernet port num ...
Страница 1108: ...1036 BigIron RX Series Configuration Guide 53 1001810 01 sFlow 39 ...
Страница 1190: ...1118 BigIron RX Series Configuration Guide 53 1001810 01 Displaying RIPng information 44 ...
Страница 1270: ...1198 BigIron RX Series Configuration Guide 53 1001810 01 Displaying ACLs 47 ...
Страница 1310: ...1238 BigIron RX Series Configuration Guide 53 1001810 01 Displaying OSPFv3 information 48 ...
Страница 1382: ...1310 BigIron RX Series Configuration Guide 53 1001810 01 Commands That Require a Reload D ...
Страница 1435: ...BigIron RX Series Configuration Guide 1363 53 1001810 01 VSRP E ...
Страница 1436: ...1364 BigIron RX Series Configuration Guide 53 1001810 01 VSRP E ...