Dell Force10 E600i FTOS Version 8.4.1.5 Configuration Guide for ExaScale - Page 142

www.dell.com | support.dell.com Step Command Syntax Command Mode 2 seq sequence-number {deny | CONFIG-EXT-NACL permit} tcp {source mask | any | host ip-address}} [count [byte] | log ] [order] [monitor] [fragments] Purpose Configure an extended IP ACL filter for TCP packets. • log and monitor options are supported on E-Series only. When you use the log keyword, CP processor logs details about the packets that match. Depending on how many packets match the log entry and at what rate, the CP may become busy as it has to log these packets' details. UDP packets: To create a filter for UDP packets with a specified sequence number, use these commands in the following sequence, starting in the CONFIGURATION mode: Step Command Syntax Command Mode Purpose 1 ip access-list extended access-list-name CONFIGURATION Create a extended IP ACL and assign it a unique name. 2 seq sequence-number {deny | CONFIG-EXT-NACL Configure an extended IP ACL filter for UDP permit} {ip-protocol-number packets. udp} {source mask | any | host ip-address} {destination • log and monitor options are supported on E-Series only. mask | any | host ip-address} [operator port [port]] [count [byte] | log ] [order] [monitor] [fragments] When you create the filters with a specific sequence number, you can create the filters in any order and the filters are placed in the correct order. Note: When assigning sequence numbers to filters, keep in mind that you might need to insert a new filter. To prevent reconfiguring multiple filters, assign sequence numbers in multiples of five or another number. The following example illustrates how the seq command orders the filters according to the sequence number assigned. In the example, filter 15 was configured before filter 5, but the show config command displays the filters in the correct order. FTOS(config-ext-nacl)#seq 15 deny ip host 112.45.0.0 any log FTOS(config-ext-nacl)#seq 5 permit tcp 12.1.3.45 0.0.255.255 any FTOS(config-ext-nacl)#show confi ! ip access-list extended dilling seq 5 permit tcp 12.1.0.0 0.0.255.255 any seq 15 deny ip host 112.45.0.0 any log FTOS(config-ext-nacl)# 142 | IP Access Control Lists (ACL), Prefix Lists, and Route-maps