Users Guide

588 | External Services Interface Dell PowerConnect ArubaOS 5.0 | [User Guide
Adding a New Parser Rule in the WebUI
To add a new syslog parser rule for the route-mode example:
1. Click Add in the Syslog Parser Rules tab (Advanced Services > External Services > Syslog Parser Rule).
The system displays the new rule view.
2. In the Rule Name text box, type the name of the rule to be added (in this example, “forti_virus”).
3. Click the Enable checkbox to enable the rule.
4. In the Condition Pattern text box, type the regular expression to be used as the condition pattern. (In this
example, the expression “log_id=[0–9]{10}[ ]” searches for and matches a 10-digit string preceded by
“log_id=” and followed by one space.)
5. In the drop-down Match list, use the drop-down menu to select the match type (in this example, ipaddr).
6. In the Match Pattern text box, type the regular expression to be used as the match pattern (in this example,
“src=(.*)[ ]”).
7. In the drop-down Set list, select the set type (in this example, blacklist).
8. In the drop-down Parser Group list, select one of the configured parser domain names (in this example,
“forti_domain”).
9. Click Apply.
In the CLI
Use these CLI commands to define a syslog parser domain and the rule to be applied in the route-mode example
shown in Figure 124 on page 583.
esi parser domain name
peer peer-ip
server ipaddr
esi parser rule rule-name
condition expression
domain name
enable
match {ipaddr expression | mac expression | user expression }
position position
set {blacklist | role role}
For example:
esi parser domain forti_domain
server 10.168.172.3
esi parser rule forti_virus
condition “log_id=[0-9]{10}[ ]”
match ipaddr “src=(.*)[ ]”
set blacklist
enable
Example NAT-mode ESI Topology
This section describes the configuration for a sample NAT-mode topology using the controller and three external
captive-portal servers. NAT mode uses a trusted interface for each external captive-portal server and a different
destination port to redirect a packet to a port other than the original destination port in the packet. An example
topology is shown below in .