28.06.2014 Views

Discussion

Discussion

Discussion

SHOW MORE
SHOW LESS

You also want an ePaper? Increase the reach of your titles

YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.

04:58:41 pfe A t1-0/0/3.0 TCP 10.0.31.1<br />

10.0.31.2<br />

You can also save the activity records to a standard system logfile:<br />

[edit firewall filter incoming-to-me]<br />

aviva@RouterF# set term final-accept then syslog<br />

aviva@RouterF# set term final-accept then accept<br />

Then configure a system logfile to accept the log messages:<br />

[edit system syslog]<br />

aviva@RouterF# set file messages firewall any<br />

<strong>Discussion</strong><br />

You can log the activity of a term in a firewall filter using the log facility that is built<br />

into the firewall filter software itself. Configure this with a set then log command.<br />

You can log accepted and rejected packets but not discarded ones. This configuration<br />

stores all the activity in real time on the router, not in a file, so use it when you<br />

want to actively watch traffic or debug a problem.<br />

The show firewall log command displays the firewall logs. The detail option of this<br />

command shows an expanded version of the same information:<br />

aviva@RouterF> show firewall log detail<br />

Time of Log: 2005-09-07 05:00:13 UTC, Filter: pfe, Filter action: accept, Name of<br />

interface: t1-0/0/3.0<br />

Name of protocol: TCP, Packet Length: 71, Source address: 10.0.31.1:1390, Destination<br />

address: 10.0.31.2:179<br />

Time of Log: 2005-09-07 05:00:11 UTC, Filter: pfe, Filter action: accept, Name of<br />

interface: t1-0/0/3.0<br />

Name of protocol: TCP, Packet Length: 52, Source address: 10.0.31.1:1390, Destination<br />

address: 10.0.31.2:179<br />

Time of Log: 2005-09-07 04:59:43 UTC, Filter: pfe, Filter action: accept, Name of<br />

interface: t1-0/0/3.0<br />

Name of protocol: TCP, Packet Length: 71, Source address: 10.0.31.1:1390, Destination<br />

address: 10.0.31.2:179<br />

Time of Log: 2005-09-07 04:59:41 UTC, Filter: pfe, Filter action: accept, Name of<br />

interface: t1-0/0/3.0<br />

Name of protocol: TCP, Packet Length: 52, Source address: 10.0.31.1:1390, Destination<br />

address: 10.0.31.2:179<br />

In the output, the first field shows when the packet was received. Looking at the<br />

times in this output, you see that the firewall log facility places the latest messages at<br />

the beginning of the output. This is the opposite of system logfiles, which have the<br />

newest entries at the end. The Filter field shows pfe, which means that the packet<br />

was handled by the JUNOS PFE. The Action and Filter action fields show the fate of<br />

the packet. In this output, all packets were accepted (in the standard output, this<br />

shows as an A). Packets can also be Discard (D) or Reject (R).<br />

The next two fields show the interface on which the filter is configured and the protocol<br />

type of the packet. The last two fields show the packet’s source and destination<br />

addresses. In the detail output, the address also includes the port number being used.<br />

Logging the Traffic on an Interface | 317<br />

This is the Title of the Book, eMatter Edition<br />

Copyright © 2008 O’Reilly & Associates, Inc. All rights reserved.

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!