Configuring Vacl Logging - Cisco 7609 Configuration Manual

Chapter 23 Configuring Network Security
When configuring a capture port, note the following syntax information:
•
•
This example shows how to configure a Fast Ethernet interface 5/1 as a capture port:
Router(config)# interface gigabitEthernet 5/1
Router(config-if)# switchport capture
Router(config-if)# end
This example shows how to display VLAN access map information:
Router# show vlan access-map mordred
Vlan access-map "mordred"
Router#
This example shows how to display mappings between VACLs and VLANs. For each VACL map, there
is information about the VLANs that the map is configured on and the VLANs that the map is active on.
A VACL is not active if the VLAN does not have an interface.
Router# show vlan filter
VLAN Map mordred:
Router#

Configuring VACL Logging

When you configure VACL logging, IP packets that are denied generate log messages in these situations:
•
•
•
Log messages are generated on a per-flow basis. A flow is defined as packets with the same IP addresses and
Layer 4 (UDP or TCP) port numbers. When a log message is generated, the timer and packet count is reset.
78-14064-04
With Release 12.1(13)E and later releases, you can configure any port as a capture port. With earlier
releases, only the Gigabit Ethernet monitor port on the IDS module can be configured as a capture
port.
When configuring a capture port with Release 12.1(13)E and later releases, note the following
syntax information:
– The vlan_list parameter can be a single VLAN ID or a comma-separated list of VLAN IDs or
VLAN ID ranges (vlan_ID–vlan_ID).
To encapsulate captured traffic, configure the capture port with the switchport trunk
–
encapsulation command (see the
page 7-8) before you enter the switchport capture command.
– To not encapsulate captured traffic, configure the capture port with the switchport mode access
command (see the "Configuring a LAN Interface as a Layer 2 Access Port" section on
page 7-14) before you enter the switchport capture command.
The capture port supports only egress traffic. No traffic can enter the router through a
–
capture port.
match: ip address net_10
action: forward capture
Configured on VLANs:
Active on VLANs:
When the first matching packet is received
For any matching packets received during the last 5-minute interval
If the threshold is reached before the 5-minute interval
"Configuring a Layer 2 Switching Port as a Trunk" section on
10
2,4-6
2,4-6
Cisco 7600 Series Router Cisco IOS Software Configuration Guide—12.1E
Configuring VLAN ACLs
23-17