Solved

Need to count IP address hits

Posted on 2014-11-20
5
151 Views
Last Modified: 2014-12-17
Hello

Task - I have been asked to check if certain NAT rules are being utilized at this time, usually this would be a matter of looking at the firewall (ASA in my case) or to simply look at the end devices to check if there's any incoming traffic from the outside. Either option is not available right now.

Scenario - We currently use the ISP as our firewall, they firewall and NAT outside addresses into our internal addresses. The ISP doesn't provide NAT metrics to us. Incoming traffic hits our edge router and then our ASA (used for VPN mostly).

What I have tried - I put an ACL on our edge router interface (in) permitting the NATted to internal ip addresses expecting to  see some ACL matches if hit. See text below for ACL and interface configs.
ON the ACL I have tried with and without the "LOG" option.

What is the method to collect IP traffic information on a Cisco 1941?

Any assistance would be greatly appreciated.

Thanks in advance
-----------------------
R1#show access-list

Standard IP access list 88
    20 permit 192.168.111.7
    30 permit 192.168.111.8
    10 deny   192.168.55.11
    40 permit 192.168.34.27
    50 permit 192.168.31.40
    60 permit 192.168.34.18
    70 permit 192.168.32.13
    80 permit 192.168.3.33
    90 permit 192.168.25.6
    100 permit any (4920313 matches)
------------
R1#sh run int gig 0/0

interface GigabitEthernet0/0
 ip address 65.118.86.166 255.255.255.252
 ip access-group 88 in
 duplex full
 speed 100
--------------
0
Comment
Question by:CocoCounty
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
  • 2
5 Comments
 
LVL 18

Accepted Solution

by:
Garry Glendown earned 250 total points
ID: 40456733
You could also configure the ASA with rules for each device, it will also keep a counter on rule hits ... not exactly sure why you don't get any hits on the single IPs in the access list, unless the IOS is optimizing the access list matches (try adding an arbitrary deny rule between the last specific permit and the permit any rule ... not sure if that will do anything)
0
 
LVL 28

Assisted Solution

by:Jan Springer
Jan Springer earned 250 total points
ID: 40457350
if you can configure logging and log to an internal syslog server, the sky is the limit with analyzing the log data.
0
 

Author Comment

by:CocoCounty
ID: 40459485
Thank you Garry-G and Jan,

I will try both. I need to wait until Monday to do any work on the router. I will post the results then.

Thanks again
0
 
LVL 18

Expert Comment

by:Garry Glendown
ID: 40459520
If you are open to more extensive analysis, things like Netflow Accounting could deliver even more information ...
0
 

Author Comment

by:CocoCounty
ID: 40505004
The ACL with a deny statement did the job.
0

Featured Post

Online Training Solution

Drastically shorten your training time with WalkMe's advanced online training solution that Guides your trainees to action. Forget about retraining and skyrocket knowledge retention rates.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
Checking Network connectivity 3 85
Tracert fails final hop at some client offices 3 49
Exchange 2016 4 65
Need to cut my Verizon home cost 3 65
Short answer to this question: there is no effective WiFi manager in iOS devices as seen in Windows WiFi or Macbook OSx WiFi management, but this article will try and provide some amicable solutions to better suite your needs.
Meet the world's only “Transparent Cloud™” from Superb Internet Corporation. Now, you can experience firsthand a cloud platform that consistently outperforms Amazon Web Services (AWS), IBM’s Softlayer, and Microsoft’s Azure when it comes to CPU and …
Viewers will learn how to connect to a wireless network using the network security key. They will also learn how to access the IP address and DNS server for connections that must be done manually. After setting up a router, find the network security…
This video gives you a great overview about bandwidth monitoring with SNMP and WMI with our network monitoring solution PRTG Network Monitor (https://www.paessler.com/prtg). If you're looking for how to monitor bandwidth using netflow or packet s…

751 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question