ExtremeSwitching (EXOS)

  • 1.  How to log matched traffic in an ACL

    Posted 09-23-2014 19:26
    The log keyword of an ACL doesn't seem to work, take this simple policy as an example:

    entry permit_ICMP {
    if {
    protocol icmp;
    }
    then {
    permit;
    mirror-cpu;
    log;
    count icmp;
    }
    }

    The counter increments fine, the traffic is permitted (even with a deny any in the end) but there's no log.

    Looking forward for an answer for this.

    Thanks in advance.



  • 2.  RE: How to log matched traffic in an ACL

    Posted 09-23-2014 20:04
    Hello Thiago

    That log is not to log that the entry was executed in the switch log table. it means you can send the packet to the CPU and get header information in the log table.

    "log—Logs the packet header."
    "log-raw—Logs the packet header in hex format."

    In order to have that data execute into the log you need to add a filter

    "You must configure an EMS"
    "filter to log these messages, for example, configure log filter DefaultFilter add event kern.info. See the Status Monitoring and Statistics chapter for information about"

    To test that an entry is working use the counter

    Hope that helps
    P



  • 3.  RE: How to log matched traffic in an ACL

    Posted 09-23-2014 20:04
    Thank you Paul,

    When I added "configure log filter DefaultFilter add event kern.info" it started to appear in the log.



  • 4.  RE: How to log matched traffic in an ACL

    Posted 09-23-2014 23:09
    @ paul is absolutely correct.

    It's better to use EMS instead of mirror traffic to CPU.