Home » Dell Manuals » Hubs & Switches » Dell PowerSwitch S4820T » Manual Viewer

Dell PowerSwitch S4820T 9.50.1 Configuration Guide for the S4820T System - Page 147

Configuring ACL Logging, Flow-Based Monitoring Support for ACLs

View all Dell PowerSwitch S4820T manuals

Add to My Manuals
Save this manual to your list of manuals

Page 147 highlights

packets that exceeded the logging threshold value during that interval is logged when the subsequent log record (in the next interval) is generated for that ACL entry. • When you delete an ACL entry, the logging settings associated with it are also removed. • ACL logging is supported for standard and extended IPv4 ACLs, IPv6 ACLs, and standard and extended MAC ACLs. • For ACL entries applied on port-channel interfaces, one match index for every member interface of the port-channel interface is assigned. Therefore, the total available match indices of 251 are split (125 match indices for permit action and 126 match indices for the deny action). • You can configure ACL logging only on ACLs that are applied to ingress interfaces; you cannot enable logging for ACLs on egress interfaces. • The total available match rule indices is 255 with four match indices used by other modules, leaving 251 indices available for ACL logging. Configuring ACL Logging This functionality is supported on the S4820T platform. To configure the maximum number of ACL log messages to be generated and the frequency at which these messages must be generated, perform the following steps: NOTE: This example describes the configuration of ACL logging for standard IP access lists. You can enable the logging capability for standard and extended IPv4 ACLs, IPv6 ACLs, and standard and extended MAC ACLs. 1. Specify the maximum number of ACL logs or the threshold that can be generated by using the threshold-in-msgs count option with the seq, permit, or deny commands. Upon exceeding the specified maximum limit, the generation of ACL logs is terminated. You can enter a threshold in the range of 1-100. By default, 10 ACL logs are generated if you do not specify the threshold explicitly. CONFIG-STD-NACL mode seq sequence-number {deny | permit} {source [mask] | any | host ip-address} [log [threshold-in-msgs count] ] 2. Specify the interval in minutes at which ACL logs must be generated. You can enter an interval in the range of 1-10 minutes. The default frequency at which ACL logs are generated is 5 minutes. If ACL logging is stopped because the configured threshold has exceeded, it is re-enabled after the logging interval period elapses. ACL logging is supported for standard and extended IPv4 ACLs, IPv6 ACLs, and standard and extended MAC ACLs. Configure ACL logging only on ACLs that are applied to ingress interfaces; you cannot enable logging for ACLs that are associated with egress interfaces. CONFIG-STD-NACL mode seq sequence-number {deny | permit} {source [mask] | any | host ip-address} [log [interval minutes]] Flow-Based Monitoring Support for ACLs Flow-based monitoring is supported on the S4820T platform. Flow-based monitoring conserves bandwidth by monitoring only the specified traffic instead of all traffic on the interface. It is available for Layer 2 and Layer 3 ingress traffic. You can specify traffic using standard or extended access-lists. This mechanism copies incoming packets that matches the ACL rules applied on the ingress port and forwards (mirrors) them to another port. The source port is the monitored port (MD) and the destination port is the monitoring port (MG). Access Control Lists (ACLs) 147

Section	Page
Dell Configuration Guide for the S4820T System 9.5(0.1)	3
About this Guide	35
Audience	35
Conventions	35
Related Documents	35
Configuration Fundamentals	36
Accessing the Command Line	36
CLI Modes	36
Navigating CLI Modes	37
The do Command	40
Undoing Commands	41
Obtaining Help	42
Entering and Editing Commands	42
Command History	43
Filtering show Command Outputs	43
Multiple Users in Configuration Mode	45
Getting Started	46
Console Access	46
Serial Console	46
Accessing the CLI Interface and Running Scripts Using SSH	47
S4820T	47
Entering CLI commands Using an SSH Connection	48
Executing Local CLI Scripts Using an SSH Connection	48
Default Configuration	49
Configuring a Host Name	49
Accessing the System Remotely	49
Accessing the S4820T and Remotely	49
Configure the Management Port IP Address	49
Configure a Management Route	50
Configuring a Username and Password	50
Configuring the Enable Password	50
Configuration File Management	51
Copy Files to and from the System	51
Save the Running-Configuration	52
Configure the Overload Bit for a Startup Scenario	53
Viewing Files	53
Managing the File System	54
Enabling Software Features on Devices Using a Command Option	55
View Command History	56
Upgrading Dell Networking OS	56
Using HTTP for File Transfers	56
Using Hashes to Validate Software Images	56
Management	59
Configuring Privilege Levels	59
Creating a Custom Privilege Level	59
Removing a Command from EXEC Mode	59
Moving a Command from EXEC Privilege Mode to EXEC Mode	59
Allowing Access to CONFIGURATION Mode Commands	60
Allowing Access to the Following Modes	60
Applying a Privilege Level to a Username	62
Applying a Privilege Level to a Terminal Line	62
Configuring Logging	62
Audit and Security Logs	63
Configuring Logging Format	64
Display the Logging Buffer and the Logging Configuration	65
Setting Up a Secure Connection to a Syslog Server	66
Log Messages in the Internal Buffer	67
Configuration Task List for System Log Management	67
Disabling System Logging	67
Sending System Messages to a Syslog Server	67
Configuring a UNIX System as a Syslog Server	68
Changing System Logging Settings	68
Display the Logging Buffer and the Logging Configuration	69
Configuring a UNIX Logging Facility Level	70
Synchronizing Log Messages	71
Enabling Timestamp on Syslog Messages	71
File Transfer Services	72
Configuration Task List for File Transfer Services	72
Enabling the FTP Server	72
Configuring FTP Server Parameters	73
Configuring FTP Client Parameters	73
Terminal Lines	74
Denying and Permitting Access to a Terminal Line	74
Configuring Login Authentication for Terminal Lines	75
Setting Time Out of EXEC Privilege Mode	76
Using Telnet to get to Another Network Device	76
Lock CONFIGURATION Mode	77
Viewing the Configuration Lock Status	77
Recovering from a Forgotten Password on the S4820T System	78
Recovering from a Forgotten Enable Password on the S4820T	79
Recovering from a Failed Start on the S4820T System	80
Restoring the Factory Default Settings	80
S4820TMXL Switch	80
Important Points to Remember	80
Restoring Factory Default Environment Variables	81
802.1ag	83
Ethernet CFM	83
Maintenance Domains	84
Maintenance Points	84
Maintenance End Points	85
Implementation Information	86
Configuring the CFM	86
Related Configuration Tasks	86
Enabling Ethernet CFM	86
Creating a Maintenance Domain	86
Creating a Maintenance Association	87
Create Maintenance Points	87
Creating a Maintenance End Point	87
Creating a Maintenance Intermediate Point	88
Displaying the MP Databases	89
Continuity Check Messages	90
Enabling CCM	91
Enabling Cross-Checking	91
Sending Loopback Messages and Responses	91
Sending Linktrace Messages and Responses	92
Caching Link Trace	92
Enabling CFM SNMP Traps	93
Displaying Ethernet CFM Statistics	95
802.1X	96
The Port-Authentication Process	97
EAP over RADIUS	99
Configuring 802.1X	99
Related Configuration Tasks	99
Important Points to Remember	100
Enabling 802.1X	100
Configuring Request Identity Re-Transmissions	102
Configuring a Quiet Period after a Failed Authentication	102
Forcibly Authorizing or Unauthorizing a Port	103
Re-Authenticating a Port	104
Configuring Timeouts	105
Configuring Dynamic VLAN Assignment with Port Authentication	106
Guest and Authentication-Fail VLANs	107
Configuring a Guest VLAN	108
Configuring an Authentication-Fail VLAN	108
Access Control List (ACL) VLAN Groups and Content Addressable Memory (CAM)	110
Optimizing CAM Utilization During the Attachment of ACLs to VLANs	110
Guidelines for Configuring ACL VLAN groups	111
Configuring ACL VLAN Groups and Configuring FP Blocks for VLAN Parameters	112
Viewing CAM Usage	114
Allocating FP Blocks for VLAN Processes	115
Access Control Lists (ACLs)	117
IP Access Control Lists (ACLs)	118
CAM Usage	118
Implementing ACLs on Dell Networking OS	120
IP Fragment Handling	121
IP Fragments ACL Examples	121
Layer 4 ACL Rules Examples	122
Configure a Standard IP ACL	123
Configuring a Standard IP ACL Filter	124
Configure an Extended IP ACL	125
Configuring Filters with a Sequence Number	125
Configuring Filters Without a Sequence Number	126
Configure Layer 2 and Layer 3 ACLs	127
Assign an IP ACL to an Interface	128
Applying an IP ACL	128
Counting ACL Hits	129
Configure Ingress ACLs	129
Configure Egress ACLs	130
Applying Egress Layer 3 ACLs (Control-Plane)	131
IP Prefix Lists	131
Implementation Information	132
Configuration Task List for Prefix Lists	132
ACL Resequencing	136
Resequencing an ACL or Prefix List	137
Route Maps	138
Implementation Information	138
Important Points to Remember	138
Configuration Task List for Route Maps	139
Configuring Match Routes	141
Configuring Set Conditions	143
Configure a Route Map for Route Redistribution	144
Configure a Route Map for Route Tagging	144
Continue Clause	145
Logging of ACL Processes	145
Guidelines for Configuring ACL Logging	146
Configuring ACL Logging	147
Flow-Based Monitoring Support for ACLs	147
Behavior of Flow-Based Monitoring	148
Enabling Flow-Based Monitoring	149
Bidirectional Forwarding Detection (BFD)	151
How BFD Works	151
BFD Packet Format	152
BFD Sessions	154
BFD Three-Way Handshake	154
Session State Changes	155
Important Points to Remember	156
Configure BFD	156
Configure BFD for Physical Ports	157
Configure BFD for Static Routes	160
Configure BFD for OSPF	162
Configure BFD for OSPFv3	165
Configure BFD for IS-IS	166
Configure BFD for BGP	169
Configure BFD for VRRP	176
Configuring Protocol Liveness	179
Troubleshooting BFD	179
Border Gateway Protocol IPv4 (BGPv4)	181
Autonomous Systems (AS)	181
Sessions and Peers	183
Establish a Session	184
Route Reflectors	184
BGP Attributes	185
Best Path Selection Criteria	186
Weight	188
Local Preference	188
Multi-Exit Discriminators (MEDs)	189
Origin	190
AS Path	191
Next Hop	191
Multiprotocol BGP	192
Implement BGP with Dell Networking OS	192
Additional Path (Add-Path) Support	192
Advertise IGP Cost as MED for Redistributed Routes	192
Ignore Router-ID for Some Best-Path Calculations	193
Four-Byte AS Numbers	193
AS4 Number Representation	194
AS Number Migration	195
BGP4 Management Information Base (MIB)	197
Important Points to Remember	197
Configuration Information	198
BGP Configuration	198
Enabling BGP	199
Configuring AS4 Number Representations	203
Configuring Peer Groups	205
Configuring BGP Fast Fall-Over	207
Configuring Passive Peering	209
Maintaining Existing AS Numbers During an AS Migration	210
Allowing an AS Number to Appear in its Own AS Path	211
Enabling Graceful Restart	212
Enabling Neighbor Graceful Restart	213
Filtering on an AS-Path Attribute	213
Regular Expressions as Filters	215
Redistributing Routes	216
Enabling Additional Paths	217
Configuring IP Community Lists	217
Configuring an IP Extended Community List	219
Filtering Routes with Community Lists	220
Manipulating the COMMUNITY Attribute	220
Changing MED Attributes	222
Changing the LOCAL_PREFERENCE Attribute	222
Changing the NEXT_HOP Attribute	223
Changing the WEIGHT Attribute	224
Enabling Multipath	224
Filtering BGP Routes	224
Filtering BGP Routes Using Route Maps	226
Filtering BGP Routes Using AS-PATH Information	227
Configuring BGP Route Reflectors	227
Aggregating Routes	228
Configuring BGP Confederations	229
Enabling Route Flap Dampening	229
Changing BGP Timers	232
Enabling BGP Neighbor Soft-Reconfiguration	232
Route Map Continue	234
Enabling MBGP Configurations	234
BGP Regular Expression Optimization	235
Debugging BGP	235
Storing Last and Bad PDUs	236
Capturing PDUs	237
PDU Counters	238
Sample Configurations	239
Content Addressable Memory (CAM)	245
CAM Allocation	245
Test CAM Usage	247
View CAM Profiles	247
View CAM-ACL Settings	248
View CAM Usage	250
CAM Optimization	251
Troubleshoot CAM Profiling	251
CAM Profile Mismatches	251
QoS CAM Region Limitation	251
Control Plane Policing (CoPP)	253
Configure Control Plane Policing	254
Configuring CoPP for Protocols	255
Configuring CoPP for CPU Queues	257
CoPP for OSPFv3 Packets	258
Configuring CoPP for OSPFv3	261
Show Commands	262
Data Center Bridging (DCB)	264
Ethernet Enhancements in Data Center Bridging	264
Priority-Based Flow Control	265
Enhanced Transmission Selection	266
Data Center Bridging Exchange Protocol (DCBx)	268
Data Center Bridging in a Traffic Flow	269
Enabling Data Center Bridging	269
QoS dot1p Traffic Classification and Queue Assignment	270
Configuring Priority-Based Flow Control	271
Configuring Lossless Queues	273
Configuring the PFC Buffer in a Switch Stack	274
Configure Enhanced Transmission Selection	275
ETS Prerequisites and Restrictions	275
Creating a QoS DCB Output Policy	276
Creating an ETS Priority Group	277
Applying an ETS Output Policy for a Priority Group to an Interface	278
ETS Operation with DCBx	280
Configuring Bandwidth Allocation for DCBx CIN	280
Applying DCB Policies in a Switch Stack	281
Applying DCB Policies with an ETS Configuration	281
Configure a DCBx Operation	282
DCBx Operation	282
DCBx Port Roles	283
DCB Configuration Exchange	284
Configuration Source Election	285
Propagation of DCB Information	285
Auto-Detection and Manual Configuration of the DCBx Version	286
DCBx Example	286
DCBx Prerequisites and Restrictions	287
Configuring DCBx	287
Verifying the DCB Configuration	291
PFC and ETS Configuration Examples	302
Using PFC and ETS to Manage Data Center Traffic	303
PFC and ETS Configuration Command Examples	304
Using PFC and ETS to Manage Converged Ethernet Traffic in a Switch Stack	305
Hierarchical Scheduling in ETS Output Policies	306
Configuring DCB Maps and its Attributes	306
DCB Map: Configuration Procedure	306
Important Points to Remember	307
Applying a DCB Map on a Port	308
Configuring PFC without a DCB Map	308
Configuring Lossless Queues	309
Priority-Based Flow Control Using Dynamic Buffer Method	310
Pause and Resume of Traffic	310
Buffer Sizes for Lossless or PFC Packets	311
Interworking of DCB Map With DCB Buffer Threshold Settings	311
Configuring the Dynamic Buffer Method	312
Dynamic Host Configuration Protocol (DHCP)	314
DHCP Packet Format and Options	314
Assign an IP Address using DHCP	316
Implementation Information	317
Configure the System to be a DHCP Server	318
Configuring the Server for Automatic Address Allocation	318
Specifying a Default Gateway	320
Configure a Method of Hostname Resolution	320
Using DNS for Address Resolution	320
Using NetBIOS WINS for Address Resolution	320
Creating Manual Binding Entries	321
Debugging the DHCP Server	321
Using DHCP Clear Commands	321
Configure the System to be a Relay Agent	322
Configure the System to be a DHCP Client	324
DHCP Client Operation with Other Features	324
DHCP Client on a Management Interface	325
Configure the System for User Port Stacking (Option 230)	326
Configure Secure DHCP	326
Option 82	326
DHCP Snooping	327
Drop DHCP Packets on Snooped VLANs Only	329
Dynamic ARP Inspection	329
Configuring Dynamic ARP Inspection	331
Source Address Validation	332
Enabling IP Source Address Validation	332
DHCP MAC Source Address Validation	332
Enabling IP+MAC Source Address Validation	333
Equal Cost Multi-Path (ECMP)	334
ECMP for Flow-Based Affinity	334
Configuring the Hash Algorithm	334
Enabling Deterministic ECMP Next Hop	334
Configuring the Hash Algorithm Seed	335
Link Bundle Monitoring	335
Managing ECMP Group Paths	336
Creating an ECMP Group Bundle	337
Modifying the ECMP Group Threshold	337
FCoE Transit	339
Fibre Channel over Ethernet	339
Ensure Robustness in a Converged Ethernet Network	339
FIP Snooping on Ethernet Bridges	341
FIP Snooping in a Switch Stack	343
Using FIP Snooping	343
FIP Snooping Prerequisites	343
Important Points to Remember	344
Enabling the FCoE Transit Feature	344
Enable FIP Snooping on VLANs	345
Configure the FC-MAP Value	345
Configure a Port for a Bridge-to-Bridge Link	345
Configure a Port for a Bridge-to-FCF Link	345
Impact on Other Software Features	345
FIP Snooping Restrictions	346
Configuring FIP Snooping	346
Displaying FIP Snooping Information	347
FCoE Transit Configuration Example	353
Enabling FIPS Cryptography	355
Configuration Tasks	355
Preparing the System	355
Enabling FIPS Mode	356
Generating Host-Keys	356
Monitoring FIPS Mode Status	357
Disabling FIPS Mode	357
Force10 Resilient Ring Protocol (FRRP)	359
Protocol Overview	359
Ring Status	360
Multiple FRRP Rings	361
Important FRRP Points	361
Important FRRP Concepts	361
Implementing FRRP	363
FRRP Configuration	363
Creating the FRRP Group	363
Configuring the Control VLAN	364
Configuring and Adding the Member VLANs	365
Setting the FRRP Timers	366
Clearing the FRRP Counters	367
Viewing the FRRP Configuration	367
Viewing the FRRP Information	367
Troubleshooting FRRP	368
Configuration Checks	368
Sample Configuration and Topology	368
GARP VLAN Registration Protocol (GVRP)	370
Important Points to Remember	370
Configure GVRP	371
Related Configuration Tasks	371
Enabling GVRP Globally	372
Enabling GVRP on a Layer 2 Interface	372
Configure GVRP Registration	372
Configure a GARP Timer	373
RPM Redundancy	374
High Availability (HA)	375
Component Redundancy	375
RPM Redundancy	375
Automatic and Manual Stack Unit Failover	377
Support for RPM Redundancy by Dell Networking OS Version	378
Synchronization between Management and Standby Units	378
Configuring RPM Redundancy	378
Online Insertion and Removal	380
RPM Online Insertion and Removal	380
Linecard Online Insertion and Removal	380
Hitless Behavior	381
Graceful Restart	382
Software Resiliency	382
Software Component Health Monitoring	382
System Health Monitoring	383
Failure and Event Logging	383
Hot-Lock Behavior	384
Process Restartability	384
Enabling Process Restartability	384
Internet Group Management Protocol (IGMP)	386
IGMP Implementation Information	386
IGMP Protocol Overview	386
IGMP Version 2	386
IGMP Version 3	388
Configure IGMP	391
Related Configuration Tasks	391
Viewing IGMP Enabled Interfaces	392
Selecting an IGMP Version	392
Viewing IGMP Groups	393
Adjusting Timers	393
Adjusting Query and Response Timers	393
Adjusting the IGMP Querier Timeout Value	394
Configuring a Static IGMP Group	394
Enabling IGMP Immediate-Leave	395
IGMP Snooping	395
IGMP Snooping Implementation Information	395
Configuring IGMP Snooping	395
Removing a Group-Port Association	396
Disabling Multicast Flooding	396
Specifying a Port as Connected to a Multicast Router	397
Configuring the Switch as Querier	397
Fast Convergence after MSTP Topology Changes	398
Egress Interface Selection (EIS) for HTTP and IGMP Applications	398
Protocol Separation	399
Enabling and Disabling Management Egress Interface Selection	400
Handling of Management Route Configuration	401
Handling of Switch-Initiated Traffic	401
Handling of Switch-Destined Traffic	402
Handling of Transit Traffic (Traffic Separation)	403
Mapping of Management Applications and Traffic Type	403
Behavior of Various Applications for Switch-Initiated Traffic	404
Behavior of Various Applications for Switch-Destined Traffic	405
Interworking of EIS With Various Applications	406
Designating a Multicast Router Interface	407
Interfaces	408
Basic Interface Configuration	408
Advanced Interface Configuration	408
Interface Types	409
View Basic Interface Information	409
Enabling a Physical Interface	411
Physical Interfaces	411
Configuration Task List for Physical Interfaces	412
Overview of Layer Modes	412
Configuring Layer 2 (Data Link) Mode	412
Configuring Layer 2 (Interface) Mode	413
Configuring Layer 3 (Network) Mode	413
Configuring Layer 3 (Interface) Mode	414
Egress Interface Selection (EIS)	414
Important Points to Remember	415
Configuring EIS	415
Management Interfaces	415
Configuring Management Interfaces	415
Configuring Management Interfaces on the S-Series	416
VLAN Interfaces	417
Loopback Interfaces	418
Null Interfaces	418
Port Channel Interfaces	418
Port Channel Definition and Standards	419
Port Channel Benefits	419
Port Channel Implementation	419
10/100/1000 Mbps Interfaces in Port Channels	420
Configuration Tasks for Port Channel Interfaces	420
Creating a Port Channel	420
Adding a Physical Interface to a Port Channel	421
Reassigning an Interface to a New Port Channel	423
Configuring the Minimum Oper Up Links in a Port Channel	424
	424
Assigning an IP Address to a Port Channel	425
Deleting or Disabling a Port Channel	425
Load Balancing Through Port Channels	425
Load-Balancing on the S- Series	425
Changing the Hash Algorithm	426
Bulk Configuration	427
Interface Range	427
Bulk Configuration Examples	428
Defining Interface Range Macros	429
Define the Interface Range	430

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1,000
1,001
1,002
1,003
1,004
1,005
1,006
1,007
1,008
1,009
1,010
1,011
1,012
1,013
1,014
1,015
1,016
1,017
1,018
1,019
1,020
1,021
1,022
1,023
1,024
1,025
1,026
1,027
1,028
1,029
1,030
1,031
1,032
1,033
1,034
1,035
1,036
1,037
1,038
1,039
1,040
1,041
1,042
1,043
1,044
1,045
1,046
1,047
1,048
1,049
1,050
1,051
1,052
1,053
1,054
1,055
1,056
1,057
1,058
1,059
1,060
1,061
1,062
1,063
1,064
1,065
1,066
1,067
1,068
1,069
1,070
1,071
1,072
1,073
1,074
1,075
1,076
1,077
1,078
1,079
1,080
1,081
1,082
1,083
1,084
1,085
1,086
1,087
1,088
1,089
1,090

Match case Limit results 1 per page

packets that exceeded the logging threshold value during that interval is logged when the subsequent

log record (in the next interval) is generated for that ACL entry.

•

When you delete an ACL entry, the logging settings associated with it are also removed.

•

ACL logging is supported for standard and extended IPv4 ACLs, IPv6 ACLs, and standard and extended

MAC ACLs.

•

For ACL entries applied on port-channel interfaces, one match index for every member interface of

the port-channel interface is assigned. Therefore, the total available match indices of 251 are split (125

match indices for permit action and 126 match indices for the deny action).

•

You can configure ACL logging only on ACLs that are applied to ingress interfaces; you cannot enable

logging for ACLs on egress interfaces.

•

The total available match rule indices is 255 with four match indices used by other modules, leaving

251 indices available for ACL logging.

Configuring ACL Logging

This functionality is supported on the S4820T platform.

To configure the maximum number of ACL log messages to be generated and the frequency at which

these messages must be generated, perform the following steps:

NOTE:

This example describes the configuration of ACL logging for standard IP access lists. You can

enable the logging capability for standard and extended IPv4 ACLs, IPv6 ACLs, and standard and

extended MAC ACLs.

Specify the maximum number of ACL logs or the threshold that can be generated by using the

threshold-in-msgs

count

option with the seq, permit, or deny commands. Upon exceeding the

specified maximum limit, the generation of ACL logs is terminated. You can enter a threshold in the

range of 1-100. By default, 10 ACL logs are generated if you do not specify the threshold explicitly.

CONFIG-STD-NACL mode

seq

sequence-number

{deny | permit} {source [mask] | any | host

ip-address

}

[log [threshold-in-msgs

count

] ]

Specify the interval in minutes at which ACL logs must be generated. You can enter an interval in the

range of 1-10 minutes. The default frequency at which ACL logs are generated is 5 minutes. If ACL

logging is stopped because the configured threshold has exceeded, it is re-enabled after the logging

interval period elapses. ACL logging is supported for standard and extended IPv4 ACLs, IPv6 ACLs,

and standard and extended MAC ACLs. Configure ACL logging only on ACLs that are applied to

ingress interfaces; you cannot enable logging for ACLs that are associated with egress interfaces.

CONFIG-STD-NACL mode

seq

sequence-number

{deny | permit} {source [mask] | any | host

ip-address

}

[log [interval

minutes

]]

Flow-Based Monitoring Support for ACLs

Flow-based monitoring is supported on the S4820T platform.

Flow-based monitoring conserves bandwidth by monitoring only the specified traffic instead of all traffic

on the interface. It is available for Layer 2 and Layer 3 ingress traffic. You can specify traffic using standard

or extended access-lists. This mechanism copies incoming packets that matches the ACL rules applied

on the ingress port and forwards (mirrors) them to another port. The source port is the monitored port

(MD) and the destination port is the monitoring port (MG).

Access Control Lists (ACLs)

147