If you want to capture some traffic activities that are visiting a certain IP or that are coming from one source IP for exaple, how can we capture and log this information.
The following is the commands:
[MA5200F]ip userlog export version 10
[MA5200F]ip userlog export host x.x.x.x a //X.X.X.X is the log server ip address , a is the tcp port for receive user log
[MA5200F]ip userlog flow mode flow-begin
[MA5200F]acl number 3000 // pls use an unused number
[MA5200F-acl-adv-3000]rule user-net permit ip logging destination 18.104.22.168 0 // 22.214.171.124 is the specific ip address,0 is mask, if there are more than one ip address or there is an ip segment, pls configure according to actual.
[MA5200F]access-group 3000 //apply acl, if you have aplly an acl under system view, pls configure the above rule(s) in the applied acl.
thus if the user visit the pointed ip address, MA5200F will export the user log to the log server.
Notice: the log server must setup the log software to received the user log. This software belong to Huawei-3com company.