BROCADE IP PRIMER

Chapter 14: Security, Redundancy and MoreThis actually works very well in most situations, but you may find yourself in alab situation (or an Internet-facing situation) where you want to be sure thatevery segment is checked. This can be done by issuing the followingcommand:BR-Switch#conf tBR-Switch(config)#ip strict-acl-tcpFor UDP traffic, you don't necessarily have “data” segments or “control” segments.You just have segments. As a result, every UDP segment goes throughthe same routine in a Flow-Based ACL. The switch checks the session table inCAM. If there's no entry (e.g., there's no record that the switch has let this combinationof protocol, source IP address, source port, destination IP address,and destination port through before), the segment will be handed to the CPUto process against the ACL. The CPU will then update the session table accordingly.If there is an entry in the session table, the switch will simply forward thesegment. You may find yourself in a situation where you want each UDP segmentto be analyzed by the CPU. In this case, you would need to issue thiscommand:BR-Switch#conf tBR-Switch(config)#ip strict-acl-udpACL Flow CountersIf you want to gather statistics on how your ACLs are doing, you need to enableACL statistics. This will provide two counters for your view on the CLI. The firstis the flow counter. This will count one match of the session table (or processingby the CPU) of a given session (same protocol, source IP address, sourceport, destination IP address, and destination port). If the match continuesbeyond two minutes, the flow count will increase by one again. The idea of theflow counter is to give you an approximate view of the unique session flow ofthe traffic hitting your ACL (and each of its individual lines). The second counteris the packet counter. This is an exact accounting of how many packets arebeing matched to the whole ACL, and each individual line in the ACL.It is important to note that ACL statistics will only function using Flow-BasedACLs. If you are using Rule-Based ACLs, and you enable ACL statistics, theACLs will automatically become Flow-Based.To activate ACL statistics, enter the following command:BR-Switch#conf tBR-Switch(config)#enable-acl-counterNow, you can see the counters by issuing this command:BR-Switch#show access-list 1Standard IP access list 1 (Total flows: 148, Total packets:13,324)deny host 10.1.2.3 (Flows: 56, Packets: 4,973)permit any (Flows: 92, Packets: 8,351)302 Brocade IP Primer