Exporting Nat Logs To Log Server - 3Com MSR 50 Series Configuration Manual

1826 C 96: NAT C
HAPTER
Exporting NAT logs to
Log Server
ONFIGURATION
......omitted......
%@250005%Jul
ICMP; 192.168.1.6:768--->1.1.1.1:12288; 2.2.2.2:768;
[2005/07/07 04:20:03-0000/00/00 00:00:00];
Operator 8: Data flow created
%@250006%Jul
ICMP; 192.168.1.6:768--->1.1.1.1:12288; 2.2.2.2:768;
[2005/07/07 04:20:03-2005/07/07 04:20:09];
Operator 1: Normal over
%@250007%Jul
ICMP; 192.168.1.6:768--->1.1.1.1:12288; 2.2.2.2:768;
[2005/07/07 04:20:29-0000/00/00 00:00:00];
Operator 8: Data flow created
......omitted......
Apart from NAT logs, the log file includes other system logs. The following table
shows the implies of NAT logs:
Table 56 Description on NAT logs
Field
ICMP
192.168.1.6:768
1.1.1.1:12288
2.2.2.2:768
2005/07/07 04:20:03
2005/07/07 04:20:29
2005/07/07 04:20:09
0000/00/00 00:00:00
Operator
Network requirements
A PC in the private network accesses Device B on the public network through
■
Device A, which is enabled with NAT.
Device A sends NAT logs to the information center in UDP packets;
■
7 04:20:04:72 2005 DeviceA USERLOG/7/NAT:
7 04:20:10:72 2005 DeviceA USERLOG/7/NAT:
7 04:20:30:72 2005 DeviceA USERLOG/7/NAT:
Description
ICMP
Source IP address and port number before translation
Source IP address and port number after translation
Destination IP address and port number
Start time of the NAT session (In this example, the time displayed
is the device's system time. When the logs are exported in UDP
packet, the UDP packet records the interval in seconds between
the current system time and Greenwich time 0 AM, Jan 1
The log server, based on its own system time, converts this
interval and exports it.
End time of the NAT session
0000/00/00 00:00:00 means that this time is uncertain.
Reasons for generating NAT logs come from:
Aged for reset or config-change" refers to logs generated due
■
to configuration change or manual session deletion;
Aged for no-pat of NAT" refers to logs generated when the
■
no-pat session ages;
Active data flow timeout" refers to logs generated when the
■
duration of NAT session exceeds the active data flow time;
Data flow created" refers to logs generated when a NAT
■
session is established;
Normal over" refers to logs generated when the session is
■
aged out.
st
, 1970.