On Thu, 7 May 2009, Seth Mattinen wrote:
Ingress logging works fine. Egress logging is nonexistent. Not just
dropping the occasional ones, but entirely nonexistent. The egress
filtering (by the ACL) works, it just doesn't log.
I have known for some time that ACL counters are borked on most
lower-end Catalysts, but I thought ACL logging worked.
It doesn't appear to be a known bug, but then my searching abilities may
be lacking.
Bug or feature?
Never personally expected it to work when it's not hitting the CPU.
I didn't think ACL logging worked in either direction on the 3550. I ran
across something even more disturbing recently. A customer had an
apparently compromised system found SSH scanning remote hosts. I put a
simple ACL on the customer's layer 3 port (i.e. no switchport, ip address
...),
ip access-list extended f0/48-in-acl
deny tcp any any eq 22
permit ip any any
int f0/48
ip access-group f0/48-in-acl in
According to netflow (on our 6500s upstream of the 3550s) some SSH
scanning traffic was still getting through...or remote hosts just happened
to be sending this customer tcp traffic from their port 22 to random high
ports. This is under 12.1(22)EA10b. I haven't gotten around to testing
this further.
----------------------------------------------------------------------
Jon Lewis | I route
Senior Network Engineer | therefore you are
Atlantic Net |
_________ http://www.lewis.org/~jlewis/pgp for PGP public key_________
_______________________________________________
cisco-nsp mailing list [email protected]
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/
