Description

This article describes the three options to monitor firewall filter traffic on EX-series switches.

 

Symptoms


Solution

Three options for monitoring firewall filter traffic on the EX-series Switch

  • Monitoring Traffic for All Firewall Filters and Policers That Are Configured on the Switch
  • Monitoring Traffic for a Specific Firewall Filter
  • Monitoring Traffic for a Specific Policer


Perform the following task to monitor the number of packets and bytes that matched the firewall filters and monitor the number of packets that exceeded policer rate limits:
Action

  • Use the operational mode command and issue the "show firewall" command.The show firewall command displays the names of all firewall filters, policers, and counters that are configured on the switch. The output fields show byte and packet counts for counters and packet count for policers.

user@switch> show firewall

Filter: egress-vlan-watch-employee   // (filter-name)
Counters:
Name                                                Bytes              Packets
counter-employee-web                                 3348                   27
Filter: ingress-port-voip-class-limit-tcp-icmp
Counters:
Name                                                Bytes              Packets
icmp-counter                                         4100                   49
Policers:
Name                                              Packets
icmp-connection-policer                                 0
tcp-connection-policer                                  0
Filter: ingress-vlan-rogue-block
Filter: ingress-vlan-limit-guest



Monitoring Traffic for a Specific Firewall Filter :

Perform the following task to monitor the number of packets and bytes that matched a firewall filter and monitor the number of packets that exceeded the policer rate limits.

  • Use the operational mode command and issue the "show firewall filter <filter-name> " command. The show firewall filter <filter-name command> displays the name of the firewall filter, the packet and byte count for all counters configured with the filter, and the packet count for all policers configured with the filter.

user@switch> show firewall filter <filter-name> (in that example - ingress-vlan-rogue-block)

Filter: ingress-vlan-rogue-block
Counters:
Name                                                Bytes              Packets
rogue-counter                                        2308                   20


Monitoring Traffic for a Specific Policer

  • To monitor the number of packets that exceeded policer rate limits use the operational mode command "show policer <policers-name> " . The show policer policer-name command displays the name of the firewall filter that specifies the policer-action and displays the number of packets that exceeded rate limits for the specified filter.
user@switch> show policer <policers-name> (In that example - tcp-connection-policer)

Filter: ingress-port-voip-class-limit-tcp-icmp
Policers:
Name                                              Packets
tcp-connection-policer                                  0

Related Information