9-33
Configuring and Monitoring Port Security
Reading Intrusion Alerts and Resetting Alert Flags
(The intrusion log holds up to 20 intrusion records and deletes an
intrusion record only when the log becomes full and a new intrusion
is subsequently detected.)
Note also that the “
prior to
” text in the record for the earliest intrusion
means that a switch reset occurred at the indicated time and that the
intrusion occurred prior to the reset.
3.
To acknowledge the most recent intrusion entry on port A3 and enable
the switch to enter a subsequently detected intrusion on this port, type
[R]
(for
Reset alert flags
). (Note that if there are unacknowledged intrusions
on two or more ports, this step resets the alert flags for all such ports.)
If you then re-display the port status screen, you will see that the Intrusion
Alert entry for port A3 has changed to “
No
”. That is, your evidence that the
Intrusion Alert flag has been acknowledged (reset) is that the Intrusion Alert
column in the port status display no longer shows “
Yes
” for the port on which
the intrusion occurred (port A3 in this example). (Because the Intrusion Log
provides a history of the last 20 intrusions detected by the switch, resetting
the alert flags does not change its content. Thus, displaying the Intrusion Log
again will result in the same display as in figure 9-15, above.)
