Home » Dell Manuals » Hubs & Switches » Dell C1048P Port Extender » Manual Viewer

Dell C1048P Port Extender Networking Configuration Guide for the C9000 Series - Page 133

Implementing ACLs, ACLs and VLANs, ACL Optimization

Get Dell C1048P Port Extender PDF manuals and user guides

View all Dell C1048P Port Extender manuals

Add to My Manuals
Save this manual to your list of manuals

Page 133 highlights

Current Settings(in block sizes) 1 block = 256 entries L2Acl : 1 Ipv4Acl : 1 Ipv6Acl : 2 Dell(conf)#cam-acl-egress-pe l2acl 2 ipv4acl 2 ipv6acl 0 The following example displays the running configuration for the configured CAM ACLs. Dell(conf)#do show running-config | grep cam-acl cam-acl l2acl 3 ipv4acl 4 ipv6acl 0 ipv4qos 2 l2qos 1 l2pt 0 ipmacacl 0 vman-qos 0 ecfmacl 0 ipv4pbr 2 cam-acl-pe l2acl 3 ipv4acl 2 ipv6acl 2 ipv4qos 2 l2qos 1 ipmacacl 2 cam-acl-egress-pe l2acl 2 ipv4acl 2 ipv6acl 0 Implementing ACLs You can assign one IP ACL per physical or VLAN interface. If you do not assign an IP ACL to an interface, it is not used by the software in any other capacity. The number of entries allowed per ACL is hardware-dependent. If you enable counters on IP ACL rules that are already configured, those counters are reset when a new rule is inserted or prepended. If a rule is appended, the existing counters are not affected. This is applicable to the following features: • L2 Ingress Access list • L2 Egress Access list • L3 Egress Access list ACLs and VLANs There are some differences when assigning ACLs to a VLAN rather than a physical port. For example, when using a single port-pipe, if you apply an ACL to a VLAN, one copy of the ACL entries is installed in the ACL CAM on the port-pipe. The entry looks for the incoming VLAN in the packet. Whereas if you apply an ACL on individual ports of a VLAN, separate copies of the ACL entries are installed for each port belonging to a port-pipe. When you use the log keyword, the CP has to log the details about the packets that match. Depending on how many packets match the log entry and at what rate, the CP might become busy as it has to log these packets' details. However, the Route Processor (RP) is unaffected. This option is typically useful when debugging some problem related to control traffic. We have used this option numerous times in the field and have not encountered problems so far. ACL Optimization If an access list contains duplicate entries, the system deletes one entry to conserve CAM space. Standard and extended ACLs take up the same amount of CAM space. A single ACL rule uses two CAM entries whether it is identified as a standard or extended ACL. Access Control Lists (ACLs) 133

Section	Page
Dell Networking Configuration Guide for the C9000 Series Version 9.10(0.0)	3
About this Guide	37
Audience	37
Conventions	37
Related Documents	38
Configuration Fundamentals	39
Accessing the Command Line	39
CLI Modes	40
Navigating CLI Modes	42
The do Command	45
Undoing Commands	46
Obtaining Help	46
Entering and Editing Commands	47
Command History	48
Filtering show Command Outputs	48
Multiple Users in Configuration Mode	50
Getting Started	51
Console Access	51
Serial Console	52
Mounting an NFS File System	53
Important Points to Remember	54
Default Configuration	55
Configuring a Host Name	55
Accessing the System Remotely	55
Accessing the System Remotely	55
Configure the Management Port IP Address	56
Configure a Management Route	56
Configuring a Username and Password	56
Configuring the Enable Password	57
Manage Configuration Files	57
File Storage	58
Copy Files to and from the System	58
Save the Running-Configuration	59
Configure the Overload Bit for a Startup Scenario	60
Viewing Files	60
Changes in Configuration Files	61
Viewing Command History	62
Upgrading the Dell Networking OS	62
Switch Management	63
Configuring Privilege Levels	63
Creating a Custom Privilege Level	63
Removing a Command from EXEC Mode	63
Moving a Command from EXEC Privilege Mode to EXEC Mode	64
Allowing Access to CONFIGURATION Mode Commands	64
Allowing Access to the Following Modes	64
Applying a Privilege Level to a Username	66
Applying a Privilege Level to a Terminal Line	66
Configuring Logging	66
Audit and Security Logs	67
Configuring Logging Format	69
Setting Up a Secure Connection to a Syslog Server	69
Track Login Activity	71
Restrictions for Tracking Login Activity	71
Configuring Login Activity Tracking	71
Display Login Statistics	72
Limit Concurrent Login Sessions	74
Restrictions for Limiting the Number of Concurrent Sessions	74
Configuring Concurrent Session Limit	74
Enabling the System to Clear Existing Sessions	74
Log Messages in the Internal Buffer	75
Configuration Task List for System Log Management	75
Disabling System Logging	76
Sending System Messages to a Syslog Server	76
Configuring a UNIX System as a Syslog Server	77
Display the Logging Buffer and the Logging Configuration	77
Changing System Logging Settings	78
Configuring a UNIX Logging Facility Level	79
Synchronizing Log Messages	80
Enabling Timestamp on Syslog Messages	80
File Transfer Services	81
Configuration Task List for File Transfer Services	81
Enabling the FTP Server	81
Configuring FTP Server Parameters	82
Configuring FTP Client Parameters	82
Terminal Lines	83
Denying and Permitting Access to a Terminal Line	83
Configuring Login Authentication for Terminal Lines	84
Setting Time Out of EXEC Privilege Mode	85
Using Telnet to Access Another Network Device	85
Lock CONFIGURATION Mode	86
Viewing the Configuration Lock Status	86
Recovering from a Forgotten Password	87
Ignoring the Startup Configuration and Booting from the Factory-Default Configuration	88
Recovering from a Failed Start	88
Restoring Factory-Default Settings	89
Important Point to Remember	89
Restoring Factory-Default Boot Environment Variables	90
Using Hashes to Verify Software Images Before Installation	91
Verifying System Images on C9010 Components	93
When System Images on C9010 Components Do Not Match	93
Manually Resetting the System Image on a C9010 Component	94
Logging in to the Virtual Console of a C9010 Component	95
Booting the C9010 from an Image on a Network Server	95
Configuring C9010 Components to Boot from the RPM CP Image	95
802.1X	97
The Port-Authentication Process	99
EAP over RADIUS	101
Configuring 802.1X	101
Related Configuration Tasks	101
Important Points to Remember	102
Enabling 802.1X	103
Configuring dot1x Profile	105
Configuring MAC addresses for a do1x Profile	106
Configuring the Static MAB and MAB Profile	106
Configuring Critical VLAN	107
Configuring Request Identity Re-Transmissions	108
Configuring a Quiet Period after a Failed Authentication	109
Forcibly Authorizing or Unauthorizing a Port	110
Re-Authenticating a Port	111
Configuring Dynamic VLAN Assignment with Port Authentication	112
Guest and Authentication-Fail VLANs	113
Configuring a Guest VLAN	114
Configuring an Authentication-Fail VLAN	115
Configuring Timeouts	116
Multi-Host Authentication	117
Configuring Multi-Host AuthenticationConfiguring Single-Host Authentication	120
Multi-Supplicant Authentication	121
Configuring Multi-Supplicant AuthenticationRestricting Multi-Supplicant Authentication	121
MAC Authentication Bypass	122
MAB in Single-host and Multi-Host Mode	123
MAB in Multi-Supplicant Authentication Mode	123
Configuring MAC Authentication Bypass	124
Dynamic CoS with 802.1X	125
Access Control Lists (ACLs)	127
IP Access Control Lists (ACLs)	128
CAM Usage	128
User-Configurable CAM Allocation	130
Allocating CAM for Ingress ACLs on the Port Extender	130
Allocating CAM for Egress ACLs on the Port Extender	132
Implementing ACLs	133
IP Fragment Handling	134
IP Fragments ACL Examples	135
Layer 4 ACL Rules Examples	135
Configure a Standard IP ACL	136
Configuring a Standard IP ACL Filter	137
Configure an Extended IP ACL	138
Configuring Filters with a Sequence Number	138
Configuring Filters Without a Sequence Number	140
Configure Layer 2 and Layer 3 ACLs	141
Using ACL VLAN Groups	141
Guidelines for Configuring ACL VLAN Groups	142
Configuring an ACL VLAN Group	142
Allocating ACL VLAN CAM	143
Applying an IP ACL to an Interface	144
Applying Ingress ACLs on the Port Extender	145
Applying Egress ACLs	145
Applying Layer 3 Egress ACLs on Control-Plane Traffic	146
Counting ACL Hits	147
IP Prefix Lists	147
Implementation Information	148
Configuration Task List for Prefix Lists	148
ACL Resequencing	152
Resequencing an ACL or Prefix List	152
Route Maps	154
Implementation Information	154
Important Points to Remember	154
Configuration Task List for Route Maps	155
Configuring Match Routes	157
Configuring Set Conditions	159
Configure a Route Map for Route Redistribution	160
Configure a Route Map for Route Tagging	160
Continue Clause	161
Configuring a UDF ACL	161
Hot-Lock Behavior	163
Bidirectional Forwarding Detection (BFD)	164
How BFD Works	164
BFD Packet Format	166
BFD Sessions	168
BFD Three-Way Handshake	168
Session State Changes	170
Important Points to Remember	170
Configure BFD	171
Configure BFD for Static Routes	171
Configure BFD for OSPF	173
Configure BFD for OSPFv3	176
Configure BFD for IS-IS	177
Configure BFD for BGP	180
Configure BFD for VRRP	187
Configuring Protocol Liveness	190
Border Gateway Protocol IPv4 (BGPv4)	191
Autonomous Systems (AS)	191
Sessions and Peers	194
Establish a Session	194
Route Reflectors	195
Communities	196
BGP Attributes	196
Best Path Selection Criteria	196
Weight	198
Local Preference	199
Multi-Exit Discriminators (MEDs)	199
Origin	200
AS Path	201
Next Hop	201
Multiprotocol BGP	202
Implement BGP	202
Additional Path (Add-Path) Support	202
Advertise IGP Cost as MED for Redistributed Routes	202
Ignore Router-ID for Some Best-Path Calculations	203
Four-Byte AS Numbers	203
AS4 Number Representation	204
AS Number Migration	206
BGP4 Management Information Base (MIB)	208
Important Points to Remember	208
Configuration Information	209
BGP Configuration	209
Enabling BGP	210
Configuring AS4 Number Representations	214
Configuring Peer Groups	216
Configuring BGP Fast Fail-Over	218
Configuring Passive Peering	220
Maintaining Existing AS Numbers During an AS Migration	221
Allowing an AS Number to Appear in its Own AS Path	222
Enabling Neighbor Graceful Restart	223
Filtering on an AS-Path Attribute	224
Regular Expressions as Filters	225
Redistributing Routes	227
Enabling Additional Paths	227
Configuring IP Community Lists	228
Configuring an IP Extended Community List	229
Filtering Routes with Community Lists	230
Manipulating the COMMUNITY Attribute	231
Changing MED Attributes	233
Changing the LOCAL_PREFERENCE Attribute	233
Changing the NEXT_HOP Attribute	234
Changing the WEIGHT Attribute	234
Enabling Multipath	235
Filtering BGP Routes	235
Filtering BGP Routes Using Route Maps	237
Filtering BGP Routes Using AS-PATH Information	237
Configuring BGP Route Reflectors	238
Aggregating Routes	239
Configuring BGP Confederations	239
Enabling Route Flap Dampening	240
Changing BGP Timers	243
Enabling BGP Neighbor Soft-Reconfiguration	243
Route Map Continue	245
Enabling MBGP Configurations	245
BGP Regular Expression Optimization	246
Debugging BGP	246
Storing Last and Bad PDUs	247
Capturing PDUs	248
PDU Counters	250
Sample Configurations	250
Content Addressable Memory (CAM)	260
CAM Allocation	260
Test CAM Usage	262
View CAM-ACL Settings	262
View CAM Usage	263
Return to the Default CAM Configuration	264
CAM Optimization	265
Applications for CAM Profiling	265
LAG HashingLAG Hashing Based on Bidirectional Flow	265
Unified Forwarding Table (UFT) Modes	265
Configuring UFT Modes	266
Control Plane Policing (CoPP)	268
CoPP Implementation	268
Protocol-based Control Plane Policing	268
Queue-based Control Plane Policing	269
CoPP Example	271
Configure Control Plane Policing	273
Configuring CoPP for Protocols	273
Examples of Configuring CoPP for Protocols	274
Configuring CoPP for CPU Queues	275
Examples of Configuring CoPP for CPU Queues	276
Displaying CoPP Configuration	276
Troubleshooting CoPP Operation	281
Enabling CPU Traffic Statistics	281
Viewing CPU Traffic Statistics	282
Troubleshooting CPU Packet Loss	282
Viewing Per-Protocol CoPP Counters	284
Viewing Per-Queue CoPP Counters	288
Data Center Bridging (DCB)	290
Enabling Data Center Bridging	290
Ethernet Enhancements in Data Center Bridging	291
Priority-Based Flow Control	292
Enhanced Transmission Selection	294
Data Center Bridging Exchange Protocol (DCBx)	295
Data Center Bridging in a Traffic Flow	296
QoS dot1p Traffic Classification and Queue Assignment	296
SNMP Support for PFC and Buffer Statistics Tracking	297
DCB Maps and its Attributes	298
DCB Map: Configuration Procedure	298
Important Points to Remember	299
Applying a DCB Map on a Port	299
Configuring PFC without a DCB Map	300
Configuring Lossless Queues	301
Applying a DCB Map on a Line Card	302
Data Center Bridging: Default Configuration	302
Configuration Notes: PFC and ETS in a DCB Map	303
PFC Configuration Notes	303
ETS Configuration Notes	304
ETS Prerequisites and Restrictions	305
Priority-Group Configuration Notes	305
Configuring Priority-Based Flow Control	306
Configuring Lossless Queues	307
Configuring Enhanced Transmission Selection	308
Creating an ETS Priority Group	308
ETS Operation with DCBx	309
Configure a DCBx Operation	310
DCBx Operation	310
DCBx Port Roles	310
DCB Configuration Exchange	312
Configuration Source Election	313
Propagation of DCB Information	313
Auto-Detection and Manual Configuration of the DCBx Version	314
Behavior of Tagged Packets	314
Configuration Example for DSCP and PFC Priorities	315
DCBx Example	316
DCBx Prerequisites and Restrictions	317
Configuring DCBx	317
Verifying the DCB Configuration	321
Performing PFC Using DSCP Bits Instead of 802.1p Bits	332
PFC and ETS Configuration Examples	333
Using PFC and ETS to Manage Data Center Traffic	333
PFC and ETS Configuration Command Examples	335
Using PFC and ETS to Manage Converged Ethernet Traffic	336
Hierarchical Scheduling in ETS Output Policies	336
Priority-Based Flow Control Using Dynamic Buffer Method	337
Pause and Resume of Traffic	337
Buffer Sizes for Lossless or PFC Packets	337
Configuring the Dynamic Buffer Method	338
Debugging and Diagnostics	340
Offline Diagnostics	340
Running Port Extender Offline Diagnostics on the Switch	341
Running Offline Diagnostics on a Standalone Switch	348
TRACE Logs	371
Auto Save on Reload, Crash, or Rollover	371
Uploading Trace Logs	371
Last Restart Reason	372
show hardware Commands	372
Environmental Monitoring	375
Displaying Port Extender Environment Information	375
Display Power Supply Status	376
Display Fan Status	377
Display Transceiver Type	377
Recognize an Over-Temperature Condition	379
Troubleshoot an Over-Temperature Condition	380
Troubleshooting Packet Loss	382
Displaying Drop Counters	383
Displaying Dataplane Statistics	384
Displaying Line-Card Counters	386
Accessing Application Core Dumps	387
Mini Core Dumps	388
Full Kernel Core Dumps	388
Enabling TCP Dumps	389
Accessing Port Extender Core and Mini Core Dumps	390
Dynamic Host Configuration Protocol (DHCP)	391
DHCP Packet Format and Options	391
Assign an IP Address using DHCP	393
Implementation Information	394
Configure the System to be a DHCP Server	395
Configuring the Server for Automatic Address Allocation	396
Specifying a Default Gateway	397
Configure a Method of Hostname Resolution	397
Using DNS for Address Resolution	398
Using NetBIOS WINS for Address Resolution	398
Creating Manual Binding Entries	398
Debugging the DHCP Server	399
Using DHCP Clear Commands	399
Configure the System to be a Relay Agent	399
Configure the System to be a DHCP Client	401
DHCP Client on a Management Interface	401
DHCP Client Operation with Other Features	402
Configure Secure DHCP	403
Option 82	403
DHCP Snooping	404
Drop DHCP Packets on Snooped VLANs Only	406
Dynamic ARP Inspection	407
Configuring Dynamic ARP Inspection	408
Source Address Validation	409
Enabling IP Source Address Validation	409
DHCP MAC Source Address Validation	410
Enabling IP+MAC Source Address Validation	410
Viewing the Number of SAV Dropped Packets	411
Clearing the Number of SAV Dropped Packets	412
Equal Cost Multi-Path (ECMP)	413
ECMP for Flow-Based Affinity	413
Enabling Deterministic ECMP Next Hop	413
Configuring the Hash Algorithm Seed	413
Link Bundle Monitoring	414
Managing ECMP Group Paths	415
Creating an ECMP Group Bundle	415
Modifying the ECMP Group Threshold	416
BGP Multipath Operation with Link Bankwidth	416
Dynamic Re-calculation of Link Bankwidth	419
Weighted ECMP for Static Routes	419
ECMP Support in L3 Host and LPM Tables	420
FCoE Transit	421
Fibre Channel over Ethernet	421
Ensure Robustness in a Converged Ethernet Network	421
FIP Snooping on Ethernet Bridges	423
FIP Snooping in a Switch Stack	426
Using FIP Snooping	426
FIP Snooping Prerequisites	426
Important Points to Remember	427
Enabling the FCoE Transit Feature	427
Enable FIP Snooping on VLANs	428
Configure the FC-MAP Value	428
Configure a Port for a Bridge-to-Bridge Link	428
Configure a Port for a Bridge-to-FCF Link	428
Impact on Other Software Features	429
FIP Snooping Restrictions	429
Configuring FIP Snooping	430
Displaying FIP Snooping Information	431
FCoE Transit Configuration Example	437
FIPS Cryptography	439
Configuration Tasks	439
Preparing the System	440
Enabling FIPS Mode	440
Generating Host-Keys	441
Monitoring FIPS Mode Status	441
Disabling FIPS Mode	442
Flex Hash and Optimized Boot-Up	443
Flex Hash Capability Overview	443
Configuring the Flex Hash Mechanism	444
LACP Fast Switchover	444
Configuring LACP Fast Switchover	445
LACP	445
LACP Fast Switchover	445
RDMA Over Converged Ethernet (RoCE) Overview	445
Sample Configurations	447
	447
Preserving 802.1Q VLAN Tag Value for Lite Subinterfaces	450
Force10 Resilient Ring Protocol (FRRP)	452
Protocol Overview	452
Ring Status	453
Multiple FRRP Rings	454
Important FRRP Points	454
Implementing FRRP	455
Important FRRP Concepts	455
FRRP Configuration	456
Creating the FRRP Group	457
Configuring the Control VLAN	457
Configuring and Adding the Member VLANs	458
Setting the FRRP Timers	459
Clearing the FRRP Counters	460
Viewing the FRRP Configuration	460
Viewing the FRRP Information	460
Troubleshooting FRRP	461
Configuration Checks	461
Sample Configuration and Topology	461
GARP VLAN Registration Protocol (GVRP)	463
Important Points to Remember	463
Configure GVRP	464
Related Configuration Tasks	465
Enabling GVRP Globally	465
Enabling GVRP on a Layer 2 Interface	465
Configure GVRP Registration	466
Configure a GARP Timer	466
High Availability (HA)	468
High Availability on Chassis	468
High Availability in a PE Stack	469
Online Insertion and Removal	469
RPM Online Insertion	469
Line Card Online Insertion	469
Pre-configuring a Slot for a Line-Card Type	470
Replacing a Line Card	470
Hitless Behavior	471
Graceful Restart	472
Software Resiliency	472
System Health Monitoring	472
Failure and Event Logging	472
Trace Log	472
Core Dumps	473
System Log	473
Control Plane Redundancy	473
Control-Plane Failover	474
RPM Synchronization	475
Forcing an RPM Failover	475
Specifying an Auto-Failover Limit	475
Disabling Auto-Reboot	476
Internet Group Management Protocol (IGMP)	477
IGMP Implementation Information	477
IGMP Protocol Overview	478
IGMP Version 2	478
IGMP Version 3	479
Configure IGMP	483
Related Configuration Tasks	483
Viewing IGMP Enabled Interfaces	483
Selecting an IGMP Version	484
Viewing IGMP Groups	484
Enabling IGMP Immediate-Leave	485
IGMP Snooping	485
IGMP Snooping Implementation Information	485
Configuring IGMP Snooping	486
Removing a Group-Port Association	486
Disabling Multicast Flooding	487
Specifying a Port as Connected to a Multicast Router	487
Configuring the Switch as Querier	487
Fast Convergence after MSTP Topology Changes	488
Designating a Multicast Router Interface	489
Interfaces	490
Basic Interface Configuration	490
Advanced Interface Configuration	490
Port Numbering	492
Interface Types	495
View Basic Interface Information	495
Resetting an Interface to its Factory Default State	502
Enabling a Physical Interface	503
Physical Interfaces	503

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1,000
1,001
1,002
1,003
1,004
1,005
1,006
1,007
1,008
1,009
1,010
1,011
1,012
1,013
1,014
1,015
1,016
1,017
1,018
1,019
1,020
1,021
1,022
1,023
1,024
1,025
1,026
1,027
1,028
1,029
1,030
1,031
1,032
1,033
1,034
1,035
1,036
1,037
1,038
1,039
1,040
1,041
1,042
1,043
1,044
1,045
1,046
1,047
1,048
1,049
1,050
1,051
1,052
1,053
1,054
1,055
1,056
1,057
1,058
1,059
1,060
1,061
1,062
1,063
1,064
1,065
1,066
1,067
1,068
1,069
1,070
1,071
1,072
1,073
1,074
1,075
1,076
1,077
1,078
1,079
1,080
1,081
1,082
1,083
1,084
1,085
1,086
1,087
1,088
1,089
1,090
1,091
1,092
1,093
1,094
1,095
1,096
1,097
1,098
1,099
1,100
1,101
1,102
1,103
1,104
1,105
1,106
1,107
1,108
1,109
1,110
1,111
1,112
1,113
1,114
1,115
1,116
1,117
1,118
1,119
1,120
1,121
1,122
1,123
1,124
1,125
1,126
1,127
1,128
1,129
1,130
1,131
1,132
1,133
1,134
1,135
1,136
1,137
1,138
1,139
1,140
1,141
1,142
1,143
1,144
1,145
1,146
1,147
1,148
1,149
1,150
1,151
1,152
1,153
1,154
1,155
1,156
1,157
1,158
1,159
1,160
1,161
1,162
1,163
1,164
1,165
1,166
1,167
1,168
1,169
1,170
1,171
1,172
1,173
1,174
1,175
1,176
1,177
1,178
1,179
1,180
1,181
1,182
1,183
1,184
1,185
1,186
1,187
1,188
1,189
1,190
1,191
1,192
1,193
1,194
1,195
1,196
1,197
1,198
1,199
1,200
1,201
1,202
1,203
1,204
1,205
1,206
1,207
1,208
1,209
1,210
1,211
1,212
1,213
1,214
1,215
1,216
1,217
1,218
1,219
1,220
1,221
1,222
1,223
1,224
1,225
1,226
1,227
1,228
1,229
1,230
1,231
1,232
1,233
1,234
1,235
1,236
1,237
1,238
1,239
1,240
1,241
1,242
1,243
1,244
1,245
1,246
1,247
1,248
1,249
1,250
1,251

Match case Limit results 1 per page

Current Settings(in block sizes)

1 block = 256 entries

L2Acl

Ipv4Acl

Ipv6Acl

Dell(conf)#cam-acl-egress-pe l2acl 2 ipv4acl 2 ipv6acl 0

The following example displays the running configuration for the configured CAM ACLs.

Dell(conf)#do show running-config | grep cam-acl

cam-acl l2acl 3 ipv4acl 4 ipv6acl 0 ipv4qos 2 l2qos 1 l2pt 0 ipmacacl 0 vman-qos 0

ecfmacl 0 ipv4pbr 2

cam-acl-pe l2acl 3 ipv4acl 2 ipv6acl 2 ipv4qos 2 l2qos 1 ipmacacl 2

cam-acl-egress-pe l2acl 2 ipv4acl 2 ipv6acl 0

Implementing ACLs

You can assign one IP ACL per physical or VLAN interface. If you do not assign an IP ACL to an interface, it is

not used by the software in any other capacity.

The number of entries allowed per ACL is hardware-dependent.

If you enable counters on IP ACL rules that are already configured, those counters are reset when a new rule

is inserted or prepended. If a rule is appended, the existing counters are not affected. This is applicable to the

following features:

•

L2 Ingress Access list

•

L2 Egress Access list

•

L3 Egress Access list

ACLs and VLANs

There are some differences when assigning ACLs to a VLAN rather than a physical port.

For example, when using a single port-pipe, if you apply an ACL to a VLAN, one copy of the ACL entries is

installed in the ACL CAM on the port-pipe. The entry looks for the incoming VLAN in the packet. Whereas if

you apply an ACL on individual ports of a VLAN, separate copies of the ACL entries are installed for each port

belonging to a port-pipe.

When you use the

log

keyword, the CP has to log the details about the packets that match. Depending on

how many packets match the log entry and at what rate, the CP might become busy as it has to log these

packets’ details. However, the Route Processor (RP) is unaffected. This option is typically useful when

debugging some problem related to control traffic. We have used this option numerous times in the field and

have not encountered problems so far.

ACL Optimization

If an access list contains duplicate entries, the system deletes one entry to conserve CAM space.

Standard and extended ACLs take up the same amount of CAM space. A single ACL rule uses two CAM entries

whether it is identified as a standard or extended ACL.

Access Control Lists (ACLs)

133