Configuring Vacl Logging - Cisco WS-CBS3032-DEL Software Configuration Manual

Configuring VLAN Maps
This example shows how to deny access to a server on another VLAN by creating the VLAN map
SERVER 1 that denies access to hosts in subnet 10.1.2.0.8, host 10.1.1.4, and host 10.1.1.8 and permits
other IP traffic. The final step is to apply the map SERVER1 to VLAN 10.
Define the IP ACL that will match the correct packets.
Step 1
Switch(config)# ip access-list extended SERVER1_ACL
Switch(config-ext-nacl))# permit ip 10.1.2.0 0.0.0.255 host 10.1.1.100
Switch(config-ext-nacl))# permit ip host 10.1.1.4 host 10.1.1.100
Switch(config-ext-nacl))# permit ip host 10.1.1.8 host 10.1.1.100
Switch(config-ext-nacl))# exit
Define a VLAN map using this ACL that will drop IP packets that match SERVER1_ACL and forward
Step 2
IP packets that do not match the ACL.
Switch(config)# vlan access-map SERVER1_MAP
Switch(config-access-map)# match ip address SERVER1_ACL
Switch(config-access-map)# action drop
Switch(config)# vlan access-map SERVER1_MAP 20
Switch(config-access-map)# action forward
Switch(config-access-map)# exit
Step 3 Apply the VLAN map to VLAN 10.
Switch(config)# vlan filter SERVER1_MAP vlan-list 10.

Configuring VACL Logging

When you configure VACL logging, syslog messages are generated for denied IP packets under these
circumstances:
•
•
•
Log messages are generated on a per-flow basis. A flow is defined as packets with the same IP addresses and
Layer 4 (UDP or TCP) port numbers. If a flow does not receive any packets in the 5-minute interval, that
flow is removed from the cache. When a syslog message is generated, the timer and packet counter are
reset.
VACL logging restrictions:
•
•
Cisco Catalyst Blade Switch 3130 and 3032 for Dell Software Configuration Guide
35-36
When the first matching packet is received.
For any matching packets received within the last 5 minutes.
If the threshold is reached before the 5-minute interval.
Only denied IP packets are logged.
Packets that require logging on the outbound port ACLs are not logged if they are denied by a VACL.
Chapter 35 Configuring Network Security with ACLs
OL-13270-06