IBNS, eventid

Problemy z zakresu security (VPN, firewall, IDS/IPS itp.)

Moderatorzy: mikrobi, garfield, gangrena, Seba, aron, PatrykW

Wiadomość
Autor
Awatar użytkownika
pogrom
wannabe
wannabe
Posty: 154
Rejestracja: 24 lip 2007, 15:25
Lokalizacja: Warszawa

IBNS, eventid

#1

#1 Post autor: pogrom »

Cześć. Czy wie ktoś jak ustalić jakie event id mają poszczególne eventy?

Kod: Zaznacz cały

SW(config)#policy-map type control subscriber POLICY_DEFAULT_ACCESS_INTERFACE
SW(config-event-control-policymap)#  event ?
  aaa-available                  aaa-available event
  absolute-timeout               absolute timeout event
  agent-found                    agent found event
  authentication-failure         authentication failure event
  authentication-success         authentication success event
  authorization-failure          authorization failure event
  authorization-success          authorization success event
  identity-update                identity update event
  inactivity-timeout             inactivity timeout event
  remote-authentication-failure  authentication failure event
  remote-authentication-success  authentication remote success event
  session-disconnected           session disconnected event
  session-started                session started event
  tag-added                      tag to apply event
  tag-removed                    tag to remove event
  template-activated             template activated event
  template-activation-failed     template activation failed event
  template-deactivated           template deactivated event
  template-deactivation-failed   template deactivation failed event
  timer-expiry                   timer-expiry event
  violation                      session violation event
W jeśli w policy-map event nie jest obsłużony, to w debugu pojawia się tylko jego ID. Utrudnia to mocno debugowanie.

Seba
CCIE/CCDE Site Admin
CCIE/CCDE Site Admin
Posty: 6223
Rejestracja: 15 lip 2004, 20:35
Lokalizacja: Warsaw, PL

Re: IBNS, eventid

#2

#2 Post autor: Seba »

A jaki debug robisz?
"Two things are infinite: the universe and human stupidity; and I'm not sure about the universe."
A. Einstein

Awatar użytkownika
pogrom
wannabe
wannabe
Posty: 154
Rejestracja: 24 lip 2007, 15:25
Lokalizacja: Warszawa

Re: IBNS, eventid

#3

#3 Post autor: pogrom »

Seba pisze:A jaki debug robisz?

Kod: Zaznacz cały

#debug pre all
Jun 9 06:35:50.081: [PRE:RULE:EVENT:B4000084] Executing policy-map type control subscriber POLICY_DEFAULT_ACCESS_INTERFACE
Jun 9 06:35:50.081: [PRE:RULE:EVENT] eval_default_action: No Default action for this clid[2] and eventid[21]
Jun 9 06:35:50.081: [PRE:RULE:EVENT:B4000084] no event-id match found. nothing to run against in policy.
Jun 9 06:35:50.085: [PRE:RULE:EVENT:B4000084] Executing policy-map type control subscriber POLICY_DEFAULT_ACCESS_INTERFACE
Jun 9 06:35:50.085: [PRE:RULE:EVENT:B4000084] event (id:19 name:agent-found) match-all
Jun 9 06:35:50.085: [PRE:RULE:EVENT:B4000084] class always do-until-failure policy instance 0x9200004C
Jun 9 06:35:50.085: [PRE:RULE:EVENT:B4000084] Evaluate: class-map type control match-all subscriber always
Jun 9 06:35:50.085: [PRE:RULE:EVENT:B4000084] evaluated class map: success
Event agent-found jest obsłużony w policy-mapie i w debugu jest w postaci "czytelnej", ale nie mam pojęcia czym jest eventid[21]

ODPOWIEDZ