topic Hi,I think you should still in Network Security

IOS ZBPFW

Chris Lester — Tue, 12 Mar 2019 06:31:04 GMT

Hi All,

When configuring an ASR1001 with ZBPFW, and when using a class class-default / drop log, for an OUTSIDE_TO_SELF zone (basically the outside interface ip address), I do not see the drop action log for any dropped packets, but the drop counter is actualy incrementing.

I know the counter is incrementing because i can firstly see the counters increase, but also because i am specifically sending a load of small packets to the outside interface to see what happens under a DOS type attack.

Is this the expected result or should i actually capture the dropped traffic specifically by creating a dedicated drop class rather than rely on the class-default ?

Thanks for your help and comments.

Chris.

Hi,I think you should still

Vibhor Amrodia — Sun, 30 Aug 2015 14:10:55 GMT

Hi,

I think you should still the drop logs on the router.

What is you try to configure a "parameter map" specifically for logging the drops and then reference it in the class-default ?

Also , re-apply the policy-map configuration with "drop log" and see if that resolves this issue.

Have you enabled the Console debugging and verified if you see the drops ?

Thanks and Regards,

Vibhor Amrodia

I've got same problem on 15.5

Sergej Tiurin — Sun, 10 Apr 2016 01:01:31 GMT

I've got same problem on 15.5 ASR 1001-x.

Does anybody know a solution? This looks a bug to me so far.