Configuring Layer 4 Redirect Logging

Intelligent Services Gateway (ISG) is a Cisco IOS XE software feature set that provides a structured framework in which edge devices can deliver flexible and scalable services to subscribers. This module describes the Layer 4 Redirect Logging feature.

Prerequisites for Layer 4 Redirect Logging

The Layer 4 Redirect feature must be enabled. For configuration information, see the module “Redirecting Subscriber Traffic Using ISG Layer 4 Redirect” in the Intelligent Services Gateway Configuration Guide, Cisco IOS XE.

Information About Layer 4 Redirect Logging

ISG Layer 4 Redirect Logging

The Layer 4 Redirect Logging feature allows ISG to capture records of the creation and deletion events for Layer 4 redirect translation entries. These records can identify users who have applications that do not react to HTTP redirect.

The ISG router acts as an exporter of the Layer 4 redirect logging information, sending a UDP packet periodically to the configured external collector. The packet contains all of the Layer 4 redirect logging records, in the NetFlow version 9 export format, for IPv4, IPv6, and dual-stack sessions. The ISG router tracks every creation and deletion event for Layer 4 redirect translation entries on the router. A packet containing the logging records is generated and sent to the external collector after the first of one of the following events occurs:

  • A predefined amount of Layer 4 redirect logging data has accumulated in the local buffer.

  • A predefined amount of time has passed without the router sending any data records to the collector, and there are data records in the local buffer to be sent.

If more than one type of logging feature is configured on the same router (for example, network address translation (NAT) or Firewall), the number of events that can be generated at one time is shared among all of the logging features. Logging requests are served on a first-come first-serve basis.

Any external collector that supports the NetFlow version 9 or IP information export (IPFIX) protocol can be used to process Layer 4 redirect logging data exported by the ISG router.

Template Formats for Layer 4 Redirect Logging

The Layer 4 Redirect Logging records that the ISG router sends to the collector use a preconfigured template format. The NetFlow version 9 export packets include a NetFlow packet header followed by the data records and template records that define the structure of the data records, in a format corresponding to the configured template.

The following tables list the fields that are included in records sent to the external collector, in the basic and extended IPv4 and IPv6 templates. The fields are listed in the order in which they appear in the templates. All of the fields in the basic template are also included in the extended template. The last four fields listed in the tables below are the additional fields that are included only in the extended template.

Table 1. IPv4 Translation Entries Record in the Layer 4 Redirect Logging Template

Field Name

Field Type

Field Length (bytes)

Description

sourceIPv4Address

8

4

Source IPv4 address.

sourceTransportPort

7

2

Source port number in the transport header.

destinationIPv4Address

12

4

Destination IPv4 address.

destinationTransportPort

11

2

Destination port number in the transport header.

l4rServerIPv4Address

44000

4

Layer 4 redirect server IPv4 address.

l4rServerTransportPort

44001

2

Layer 4 redirect server port number.

protocolIdentifier

4

1

Protocol number in the IP header.

l4rEvent

44003

1

1—Translation Entry Create event

2—Translation Entry Delete event

l4rEventTimestamp

44004

4

Time stamp for this Layer 4 Redirect event.

inPackets

2

4

Incoming packet counter.

outPackets

24

4

Outgoing packet counter.

flowId

148

4

ASR internal identifier (EVSI#) of the session or traffic class on which the Layer 4 Redirect feature is configured.

Table 2. IPv6 Translation Entries Record in the Layer 4 Redirect Logging Template

Field Name

Field Type

Field Length (bytes)

Description

sourceIPv6Address

27

16

Source IPv6 address.

sourceTransportPort

7

2

Source port number in the transport header.

destinationIPv6Address

28

16

Destination IPv6 address.

destinationTransportPort

11

2

Destination port number in the transport header.

l4rServerIPv6Address

44002

16

Layer 4 redirect server IPv6 address.

l4rServerTransportPort

44001

2

Layer 4 redirect server port number.

protocolIdentifier

4

1

Protocol number in the IP header.

l4rEvent

44003

1

1—Translation Entry Create event

2—Translation Entry Delete event

l4rEventTimestamp

44004

4

Time stamp for this Layer 4 redirect event.

inPackets

2

4

Incoming packet counter.

outPackets

24

4

Outgoing packet counter.

flowId

148

4

ASR internal identifier (EVSI#) of the session or traffic class on which the L4R feature is configured.

How to Configure Layer 4 Redirect Logging

Enabling ISG Layer 4 Redirect Logging

SUMMARY STEPS

  1. enable
  2. configure terminal
  3. flow exporter exporter-name
  4. destination {ip-address | hostname } [vrf vrf-name ]
  5. source interface-type interface-number
  6. transport udp udp-port
  7. export-protocol netflow-v9
  8. template data timeout seconds
  9. exit
  10. redirect log translations {basic | extended} exporter exporter-name
  11. exit
  12. show flow exporter exporter-name

DETAILED STEPS

  Command or Action Purpose

Step 1

enable

Example:

Router> enable

Enables privileged EXEC mode.

  • Enter your password if prompted.

Step 2

configure terminal

Example:

Router# configure terminal

Enters global configuration mode.

Step 3

flow exporter exporter-name

Example:

Router(config)# flow exporter L4R-EXPORTER

Creates the flow exporter and enters flow exporter configuration mode.

  • This command also allows you to modify an existing flow exporter.

Step 4

destination {ip-address | hostname } [vrf vrf-name ]

Example:

Router(config-flow-exporter)# destination 172.16.10.2

Specifies the IP address or hostname of the destination system for the exporter.

Step 5

source interface-type interface-number

Example:

Router(config-flow-exporter)# source gigabitethernet 0/0/0

Specifies the local interface from which the exporter will use the IP address as the source IP address for exported datagrams.

Step 6

transport udp udp-port

Example:

Router(config-flow-exporter)# transport udp 650

Specifies the UDP port on which the destination system is listening for exported datagrams.

Step 7

export-protocol netflow-v9

Example:

Router(config-flow-exporter)# export-protocol netflow-v9

(Optional) Specifies the version of the NetFlow export protocol used by the exporter.

  • Default is netflow-v9 .

Step 8

template data timeout seconds

Example:

Router(config-flow-exporter)# template data timeout 120

(Optional) Configure resending of templates based on a timeout.

Step 9

exit

Example:

Router(config-flow-exporter)# exit

Exits flow exporter configuration mode and returns to global configuration mode.

Step 10

redirect log translations {basic | extended} exporter exporter-name

Example:

Router(config)# redirect log translations basic exporter L4R-EXPORTER
Enables the Layer 4 Redirect Logging feature for ISG.

  • For theexporter-name argument, enter the name of the exporter you configured in step 3.

Step 11

exit

Example:

Router(config)# exit

Exits global configuration mode and returns to privileged EXEC mode.

Step 12

show flow exporter exporter-name

Example:

Router# show flow exporter L4R-EXPORTER

(Optional) Displays the current status of the specified flow exporter.

Configuration Examples for Layer 4 Redirect Logging

Example: Enabling Layer 4 Redirect Logging

The following example shows that a flow exporter named L4R-EXPORTER is enabled to send Layer 4 Redirect logging information to an external collector: 

flow exporter L4R-EXPORTER
 destination 172.16.10.2
 source GigabitEthernet 0/0/0
 transport udp 650
 template data timeout 120
!
!
redirect log translations basic exporter L4R-EXPORTER

Example: Layer 4 Redirect Logging Events

Layer4 Redirect IPv4 Translation Entry Creation Event 

Source IPv4 Address 10.1.1.1, Port 1024,
Destination IPv4 Address 10.10.1.1, Port 80,
L4R Server IPv4 Address 10.1.10.1, Port 8000,
Protocol TCP, Translation Entry Create Event

Layer 4 Redirect IPv6 Translation Entry Deletion Event

Source IPv6 Address 1000::1, Port 1024,
Destination IPv6 Address 2000::1, Port 80,
L4R Server IPv6 Address 2001:ABCD:14::6, Port 8000, 
Protocol UDP, Translation Entry Delete Event

Additional References

Related Documents

Related Topic

Document Title

Cisco IOS commands

Cisco IOS Master Commands List, All Releases

Configuring Layer 4 redirect

“Redirecting Subscriber Traffic Using ISG Layer 4 Redirect” module in the Intelligent Services Gateway Configuration Guide, Cisco IOS XE

ISG commands

Cisco IOS Intelligent Services Gateway Command Reference

NetFlow commands

Cisco IOS NetFlow Command Reference

Technical Assistance

Description

Link

The Cisco Support and Documentation website provides online resources to download documentation, software, and tools. Use these resources to install and configure the software and to troubleshoot and resolve technical issues with Cisco products and technologies. Access to most tools on the Cisco Support and Documentation website requires a Cisco.com user ID and password.

http://www.cisco.com/cisco/web/support/index.html

Feature Information for Layer 4 Redirect Logging

The following table provides release information about the feature or features described in this module. This table lists only the software release that introduced support for a given feature in a given software release train. Unless noted otherwise, subsequent releases of that software release train also support that feature.

Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to www.cisco.com/go/cfn. An account on Cisco.com is not required.
Table 3. Feature Information for Layer 4 Redirect Logging

Feature Name

Releases

Feature Information

Layer 4 Redirect Logging Enhancement

Cisco IOS XE Release 3.5S

Allows ISG to export Layer 4 redirect logging information to an external collector.

The following command was introduced: redirect log translations.

RaBaPol Web Traffic L4 Redirect Logging Enhancement

Cisco IOS XE Release 3.5S

Allows ISG to export Layer 4 redirect logging information to an external collector.