Brocade Communications Systems ServerIron ADX 12.4.00a - Manual (Page 86)

72 ServerIron ADX Security Guide
53-1002440-03
Dropping all fragments that exactly match a flow-based ACL
2
You can also configure the maximum number of ACL-related log entries that can be added to the
system log over a one-minute period. For example, to limit the device to 100 ACL-related syslog
entries per minute.
ServerIronADX(config)# max-acl-log-num 100
Syntax: [no] max-acl-log-num <num>
You can specify a number between 0 – 4096. The default is 256. Specifying 0 disables all ACL
logging.
Displaying ACL statistics for flow-based ACLs
To display ACL statistics for flow-based ACLs, enter the following command.
ServerIronADX(config)# show ip acl-traffic
ICMP inbound packets received 400
ICMP inbound packets permitted 200
ICMP inbound packets denied 200
Syntax: show ip acl-traffic
The command lists a separate set of statistics for each of the following IP protocols:
• ICMP
• IGMP
• IGRP
• IP
• OSPF
• TCP
• UDP
• Protocol number, if an ACL is configured for a protocol not listed above
For TCP and UDP, a separate set of statistics is listed for each application port.
Clearing flow-based ACL statistics
To clear the ACL statistics, enter the following command at the Privileged EXEC level of the CLI.
ServerIronADX(config)# clear ip acl-traffic
Syntax: clear ip acl-traffic
Dropping all fragments that exactly match a flow-based ACL
For a packet fragment that is sent to the CPU for processing, the device compares the fragment’s
source and destination IP addresses against the interface’s ACL entries. By default, if the
fragment’s source and destination IP addresses exactly match an ACL entry that also has Layer 4
information (source and destination TCP or UDP application ports), the device permits or denies the
fragment according to the ACL.