Cisco PIX 525 Especificações descarregar pdf (Página 339)

9-37

Cisco PIX Firewall and VPN Configuration Guide

78-15033-01

Chapter 9 Accessing and Monitoring PIX Firewall

Using Syslog

Logging Behavior

There are some behavior differences among various types of IP traffic because access check is only

applied to those packets which do not have an existing connection. This section summarizes the logging

behavior for different types of traffic. It includes the following topics:

• TCP Example, page 9-37

• Deny Example, page 9-38

• No Log Example, page 9-38

The examples in this section are based on the behavior of a PIX Firewall configured with the following

commands:

access-group outside-acl in interface outside

... output abridged ...

access-list outside-acl permit ip host 1.1.1.1 any log 7 interval 600

access-list outside-acl permit ip host 2.2.2.2 any

access-list outside-acl deny ip any any log 2

TCP Example

1. An inbound TCP SYN packet (1.1.1.1/12345 -> 192.168.1.1/1357) arrives on the outside interface.

2. The packet is permitted by the first ACE of the outside-acl access list that has the log option enabled.

The following syslog message is generated and the log flow is cached.

106100: access-list outside-acl permitted tcp outside/1.1.1.1(12345) ->

inside/192.168.1.1(1357) hit-cnt 1 (first hit)

At the same time, a connection (1.1.1.1, 12345, 192.168.1.1, 1357) is created, which can be shown

by using a show xlate or show conn command.

3. 20 packets for this connection arrive on the outside interface. However, access checking is bypassed

because the connection for these packets already exists. Therefore, the hit count for the cached flow

is not incremented.

4. The TCP connection is terminated and deleted at the end of the first minute.

5. Steps 1 to 4 are repeated, but this time the log flow has been cached, so the hit count is incremented

from 0 to 1. Each time the TCP connection is terminated, these steps are repeated, so the hit count

reaches nine at the end of the tenth minute.

6. At the end of tenth minute after the log flow is cached, the following syslog message is generated,

and the hit count for the log flow is reset to 0.

106100: access-list outside-acl permitted tcp outside/1.1.1.1(12345)->

inside/192.168.1.1(1357) hit-cnt 9 (300-second interval)

7. No matching packets arrive on the outside interface within the next ten minutes, so the hit count for

the log flow remains at 0.

8. At the end of twentieth minute, the cached flow (TCP, 1.1.1.1, 12345, 192.168.1.1, 1357) is deleted

because the hit count remains at 0.

1 2 ... 334 335 336 337 338 339 340 341 342 343 344 ... 465 466

Sem comentários

Cisco PIX 525 Especificações Página 339