Binary Flow Log Configuration - H3C SecPath F1800-A Operation Manual

Operation Manual - System Management
H3C SecPath F1800-A Firewall
display the log information on the terminal view or output the Syslog log to the log
server for storage and analysis.
Conversely, log information on NAT or ASPF are generated in a large capacity, so the
system directly outputs this type of log traffic in binary format to the log server for
storage and analysis, regardless of the VRP-based information centre.
Therefore, the transmission efficiency of binary flow log seems to be higher than that
of Syslog log.
The SecPath F1800-A firewall only supports binary logs.
Note:
For NAT or ASPF, attack defense, blacklist and address binding in detail, refer to
"06-Security Defence Operation"

1.6.2 Binary Flow Log Configuration

Binary flow log configuration includes:
Enabling inter-zone binary flow log output
Configuring the host address and port for receiving binary flow log
Configuring regular scan interval of log buffer
I. Enabling Interzone Binary Flow Log Output
Do as follows in interzone view.
Table 1-25 Enabling interzone binary flow log output
Enable interzone binary flow log
output that matches the ACL rule.
Disable interzone binary flow log
output.
II. Configuring the Host Address and Port for Receiving Binary Flow Log
Do as follows in system view.
module in this manual.
Action
2-21
Chapter 1 System Maintenance Management
Command
session log enable
access-list { inbound | outbound }
undo session log enable { inbound |
outbound }
acl-number