Efficient Networks Router family Command Line Interface Manual page 219

®
Efficient Networks Router family
Command Line Interface Guide
For example, the command
-> remote ipfilter check input -p TCP branch1
would check what action (accept, drop, reject, inipsec, outipsec) would be taken for a
TCP packet after it was compared with the list of input filters defined for remote entry
branch1.
remote ipfilter list
remote ipfilter list <type> <remotename>
Lists all filters of the specified <type> (input, receive, transmit, or output) for this
remote entry.
remote ipfilter watch
remote ipfilter watch <on | off> [-q | -v] <remotename>
Turns on or turns off the console watch for this remote router entry. If the watch is on,
a message is printed to the console serial port when a packet is dropped or rejected.
(The message is also sent to any Syslog servers; see
However, if the parameter -q (quiet) was specified for a filter, no message is printed
when that filter matches a packet. If the parameter -v (verbose) was specified for a
filter, a message is printed whenever that filter matches a packet, regardless of the
filter action.
To see the messages, Telnet to the router and enter
continue after a
remote ipfilter watch
Parameters
The filter <type> specifies at which point the filter is compared to the IP packet (see
the illustration under
input
receive
transmit
output
If the packet matches the filter, the specified action is performed:
accept
drop
®
Efficient Networks
remote restart or save; to resume the watch, you must enter the
<on> command again.
"Filters and Interfaces" on page
When the packet enters the interface, before any network address
translation is performed.
When the packet enters the interface, after any network address
translation, but before routing table processing.
After routing table processing, before any network address transla-
tion before the packet is sent out.
After routing and network address translation, just before the packet
is sent out.
The packet is allowed to proceed for further processing.
The packet is discarded, without sending an ICMP (Internet Control
Management Protocol) error message.
Chapter 6: Remote Commands
"Syslog Client" on page
system log. The watch does not
5-23):
7-1.)
Page 6-31