Home Theater Server User Manual
Table Of Contents
- Contents
- About This Document
- Network Security
- TCP SYN attacks
- IP TCP syn-proxy
- Granular application of syn-proxy feature
- Syn-def
- No response to non-SYN first packet of a TCP flow
- Prioritizing management traffic
- Peak BP utilization with TRAP
- Transaction Rate Limit (TRL)
- Understanding transaction rate limit
- Configuring transaction rate limit
- Configuring the maximum number of rules
- Saving a TRL configuration
- Transaction rate limit command reference
- Global TRL
- TRL plus security ACL-ID
- security acl-id
- Transaction rate limit hold-down value
- Displaying TRL rules statistics
- Displaying TRL rules in a policy
- Displaying IP address with held down traffic
- Refusing new connections from a specified IP address
- HTTP TRL
- Overview of HTTP TRL
- Configuring HTTP TRL
- Displaying HTTP TRL
- Display all HTTP TRL policies
- Display HTTP TRL policy from index
- Display HTTP TRL policy client
- Display HTTP TRL policy starting from index
- Display HTTP TRL policy matching a regular expression
- Display HTTP TRL policy client index (MP)
- Display HTTP TRL policy client index (BP)
- Display HTTP TRL policy for all client entries (BP)
- Downloading an HTTP TRL policy through TFTP
- HTTP TRL policy commands
- Logging for DoS Attacks
- Maximum connections
- clear statistics dos-attack
- Maximum concurrent connection limit per client
- Firewall load balancing enhancements
- Syn-cookie threshhold trap
- Service port attack protection in hardware
- Traffic segmentation
- DNS attack protection
- Access Control List
- How ServerIron processes ACLs
- Default ACL action
- Types of IP ACLs
- ACL IDs and entries
- ACL entries and the Layer 4 CAM
- Configuring numbered and named ACLs
- Modifying ACLs
- Displaying a list of ACL entries
- Applying an ACLs to interfaces
- ACL logging
- Dropping all fragments that exactly match a flow-based ACL
- Enabling ACL filtering of fragmented packets
- Enabling hardware filtering for packets denied by flow-based ACLs
- Enabling strict TCP or UDP mode for flow-based ACLs
- ACLs and ICMP
- Using ACLs and NAT on the same interface (flow-based ACLs)
- Displaying ACL bindings
- Troubleshooting rule-based ACLs
- IPv6 Access Control Lists
- Network Address Translation
- Syn-Proxy and DoS Protection
- Understanding Syn-Proxy
- Configuring Syn-Proxy
- DDoS protection
- Configuring a security filter
- Configuring a Generic Rule
- Configuring a rule for common attack types
- Configuring a rule for ip-option attack types
- Configuring a rule for icmp-type options
- Configuring a rule for IPv6 ICMP types
- Configuring a rule for IPv6 ext header types
- Binding the filter to an interface
- Clearing DOS attack statistics
- Clearing all DDOS Filter & Attack Counters
- Logging for DoS attacks
- Displaying security filter statistics
- Address-sweep and port-scan logging
- Secure Socket Layer (SSL) Acceleration
- SSL overview
- SSL acceleration on the ServerIron ADX
- Configuring SSL on a ServerIron ADX
- Basic SSL profile configuration
- Advanced SSL profile configuration
- Configuring Real and Virtual Servers for SSL Termination and Proxy Mode
- Configuration Examples for SSL Termination and Proxy Modes
- SSL debug and troubleshooting commands
- Displaying socket information
70 ServerIron ADX Security Guide
53-1002440-03
ACL logging
2
ACL logging
You may want the software to log entries for ACLs in the syslog. This section present the how
logging is processed by rule-based ACLs.
Rule-based ACLs do not support the log option. Even when rule-based ACLs are enabled, if an ACL
entry has the log option, traffic that matches that ACL is sent to the CPU for processing. Depending
on how many entries have the log option and how often packets match those entries, ACL
performance can be affected.
If your configuration already contains ACLs that you want to use with rule-based ACLs, but some of
the ACLs contain the log option, the software changes the ACL mode to flow-based for the traffic
flows that match the ACL. Changing the mode to flow-based enables the device to send the
matching flows to the CPU for processing. This is required because the CPU is needed to generate
the Syslog message.
You can globally disable ACL logging without the need to remove the log option from each ACL
entry. When you globally disable ACL logging, the ACL entries remain unchanged but the log option
is ignored and the ACL can use the rule-based ACL mode. This enables you to use the ACLs in the
rule-based ACL mode. You also can configure the device to copy traffic that is denied by a
rule-based ACL to an interface. This option allows you to monitor the denied traffic without sending
the traffic to the CPU.
To globally disable ACL logging, enter the following command at the global CONFIG level of the CLI.
ServerIronADX(config)# ip access-list disable-log-to-cpu
Syntax: [no] ip access-list disable-log-to-cpu
To re-enable ACL logging, enter the following command.
ServerIronADX(config)# no ip access-list disable-log-to-cpu
Syslog message for changed ACL mode
If the device changes the ACL mode from rule-based to flow-based, the device generates one of the
following Syslog notification messages:
• ACL insufficient L4 session resource, using flow based ACL instead.
• ACL exceed max DMA L4 cam resource, using flow based ACL instead. Refer to “Specifying the
maximum number of CAM entries for rule-based ACLs” on page 54.
• ACL insufficient L4 cam resource, using flow based ACL instead.
Copying denied traffic to a mirror port for monitoring
Although rule-based ACLs do not support ACL logging, you nonetheless can monitor the traffic
denied by rule-based ACLs. To do so, attach a protocol analyzer to a port and enable the device to
redirect traffic denied by ACLs to that port.
To redirect traffic denied by ACLs, enter the following command at the interface configuration level.
ServerIronADX(config-if-1/1)# ip access-group redirect-deny-to-interf
Syntax: [no] ip access-group redirect-deny-to-interf
Enter the command on the port to which you want the denied traffic to be copied.