Dell MX9116n EMC SmartFabric OS10 User Guide Release 10.5.1 - Page 1254

ACL logging You can configure ACLs to filter traffic, drop or forward packets that match certain conditions. The ACL logging feature allows you to get additional information about packets that match an access control list entry (ACE) applied on an interface in inbound direction. OS10 creates a log message that includes additional information about the packet, when a matching packet hits a log-enabled ACL entry. ACL logging helps to administer and manage traffic that traverses your network and is useful for network supervision and maintenance activities. High volumes of network traffic can result in large volume of logs, which can negatively impact system performance and efficiency. You can specify the threshold after which a log is created and the interval at which the logs must be created. The threshold defines how often a log message is created after an initial packet match. The default is 10 messages. This value is configurable and the range is from 1 to 100 messages. By default, the interval is set to 5 minutes and logs are created every 5 minutes. During this interval, the system continues to examine the packets against the configured ACL rule and permits or denies traffic, but logging is halted temporarily. This value is configurable and the range is from 1 to 10 minutes. For example, if you have configured a threshold value of 20 and an interval of 10 minutes, after an initial packet match, the 20th packet that matches the ACL entry is logged. The system then waits for the interval period of 10 minutes to elapse, during which time no logging occurs. Once the interval period elapses, the 20th packet that matches the ACL entry is logged again. Important notes The ACL logging feature is: ● Applicable only for IPv4 and IPv6 user ACLs. MAC ACLs are not logged. ● Applicable only for user ACLs applied on interfaces in the inbound direction. Even though ACL logging cannot be enabled for outbound ACLs, ACL configuration is applied. If you have enabled ACL logging, downgrade from release 10.4.3.0 to a previous release fails and the corresponding ACL rules are not applied. Before you downgrade, be sure to disable ACL logging or delete the startup configuration. Dell EMC recommends that you do not enable logging for control plane protocol identical user ACL entry. DELL EMC recommends a max scale of 128 log-enabled ACL entries. If logging cannot be enabled on further ACL entries, a syslog error message appears to indicate logging cannot be enabled. However, the ACL entries are applied. ACL commands clear ip access-list counters Clears ACL counters for a specific access-list. Syntax Parameters Default Command Mode Usage Information clear ip access-list counters [access-list-name] access-list-name - (Optional) Enter the name of the IP access-list to clear counters. A maximum of 140 characters. Not configured EXEC If you do not enter an access-list name, all IPv6 access-list counters clear. The counter counts the number of packets that match each permit or deny statement in an access-list. To get a more recent count of packets matching an access list, clear the counters to start at zero. To view access-list information, use the show access-lists command. 1254 Access Control Lists