
Enterasys Xpedition User Reference Manual 293
Enabling ACL Logging
This command creates a Profile ACL called prof5 that uses as its selection criteria all
packets with a source address of 1.2.3.4 and a destination address of 10.10.10.10:
To have packets matching Profile ACL prof5’s selection criteria bypass the cache servers,
use the following command:
When the Web caching policy is applied to an interface, information in packets originating
from source address 1.2.3.4 and destined for address 10.10.10.10 is not sent to the cache
servers.
See Web Caching on page 264 for more information on using the web-cache command.
Enabling ACL Logging
To see whether incoming packets are permitted or denied because of an ACL, you can
enable ACL logging. You can enable logging when applying the ACL or you can enable
logging for a specific ACL rule.
The following commands define an ACL and apply the ACL to an interface, with logging
enabled for the ACL:
When ACL logging is turned on, the router prints out a message on the console about
whether a packet is dropped or forwarded. If you have a Syslog server configured for the
XP, the same information will also be sent to the Syslog server.
The following commands define an ACL and apply the ACL to an interface. In this case,
logging is enabled for a specific ACL rule:
For the above commands, the router prints out messages on the console only when
packets that come from subnet 10.2.0.0/16 on interface ‘int1’ are dropped.
Note that when logging is enabled on a per-rule basis, you do not need to specify the
logging on option when the ACL is applied to an interface. With per-rule logging enabled,
only the logging off option has an effect when the ACL is applied; this option turns off all
ACL logging.
ssr(config)# acl prof5 permit ip 1.2.3.4 10.10.10.10
ssr(config)# web-cache policy1 create bypass-list profile prof5
acl 101 deny ip 10.2.0.0/16 any any any
acl 101 permit ip any any any any
acl 101 apply interface int1 input logging on
acl 101 deny ip 10.2.0.0/16 any any any log
acl 101 permit ip any any any any
acl 101 apply interface int1 input
Commentaires sur ces manuels