Home » Dell Manuals » Servers » Dell Force10 S4810P » Manual Viewer

Dell Force10 S4810P S4810 Configuration Guide, FTOS 8.3.10.1 - Page 116

Established Flag, Configuring Layer 2 and Layer 3 ACLs on an Interface

View all Dell Force10 S4810P manuals

Add to My Manuals
Save this manual to your list of manuals

Page 116 highlights

www.dell.com | support.dell.com FTOS(config-ext-nacl)#show config ! ip access-list extended nimule seq 5 deny tcp host 123.55.34.0 any seq 10 permit udp 154.44.0.0 0.0.255.255 host 34.6.0.0 FTOS(config-ext-nacl)# To view all configured IP ACLs and the number of packets processed through the ACL, use the show ip accounting access-list command in the EXEC Privilege mode as shown in the first example inConfigure a standard IP ACL. Established Flag The est (established) flag is deprecated for Terascale series line cards.The flag is only available on legacy EtherScale linecards. Employ the ack and rst flags instead to achieve the same functionality. To obtain the functionality of est, use the following ACLs: • permit tcp any any rst • permit tcp any any ack Configuring Layer 2 and Layer 3 ACLs on an Interface Both Layer 2 and Layer 3 ACLs may be configured on an interface in Layer 2 mode. If both L2 and L3 ACLs are applied to an interface, the following rules apply: • The packets routed by FTOS are governed by the L3 ACL only, since they are not filtered against an L2 ACL. • The packets switched by FTOS are first filtered by the L3 ACL, then by the L2 ACL. • When packets are switched by FTOS, the egress L3 ACL does not filter the packet. For the following features, if counters are enabled on rules that have already been configured and a new rule is either inserted or prepended, all the existing counters will be reset: • L2 Ingress Access list • L3 Egress Access list • L2 Egress Access list If a rule is simply appended, existing counters are not affected. Table 7-2. L2 and L3 ACL Filtering on Switched Packets L2 ACL Behavior Deny Deny L3 ACL Behavior Deny Permit Decision on Targeted Traffic Denied by L3 ACL Permitted by L3 ACL 116 | Access Control Lists (ACLs)

Section	Page
About this Guide	29
Objectives	29
Audience	29
Conventions	29
Information Symbols	30
Related Documents	30
Configuration Fundamentals	31
Accessing the Command Line	31
CLI Modes	32
Navigating CLI Modes	33
The do Command	36
Undoing Commands	36
Obtaining Help	37
Entering and Editing Commands	37
Command History	38
Filtering show Command Outputs	39
Multiple Users in Configuration mode	40
Getting Started	41
Console access	41
Serial console	41
Accessing the RJ-45 console port with a DB-9 adapter	42
Default Configuration	42
Configure a Host Name	43
Access the System Remotely	43
Access the C-Series, E-Series, S-Series, and the Z-Series Remotely	43
Configure the Management Port IP Address	43
Configure a Management Route	44
Configure a Username and Password	44
Access the S-Series Remotely	45
Configure the Enable Password	46
Configuration File Management	46
Copy Files to and from the System	47
Important Points to Remember	47
Save the Running-configuration	48
Configure the Overload bit for Startup Scenario	49
View Files	50
View Configuration Files	51
File System Management	51
View command history	52
Upgrading FTOS	52
Management	53
Configure Privilege Levels	53
Create a Custom Privilege Level	53
Removing a command from EXEC mode	54
Move a command from EXEC privilege mode to EXEC mode	54
Allow Access to CONFIGURATION mode commands	54
Allow Access to INTERFACE, LINE, ROUTE-MAP, and ROUTER mode	54
Apply a Privilege Level to a Username	56
Apply a Privilege Level to a Terminal Line	56
Configure Logging	57
Log Messages in the Internal Buffer	57
Configuration Task List for System Log Management	57
Disable System Logging	58
Send System Messages to a Syslog Server	58
Configure a Unix System as a Syslog Server	58
Change System Logging Settings	59
Display the Logging Buffer and the Logging Configuration	59
Configure a UNIX logging facility level	60
Synchronize log messages	62
Enable timestamp on syslog messages	62
File Transfer Services	63
Configuration Task List for File Transfer Services	63
Enable FTP server	63
Configure FTP server parameters	63
Configure FTP client parameters	64
Terminal Lines	65
Deny and Permit Access to a Terminal Line	65
Configure Login Authentication for Terminal Lines	65
Time out of EXEC Privilege Mode	67
Telnet to Another Network Device	67
Lock CONFIGURATION mode	68
Viewing the Configuration Lock Status	69
Recovering from a Forgotten Password on the S4810	69
Recovering from a Forgotten Enable Password on the S4810	70
Recovering from a Failed Start on the S4810	70
802.1ag	73
Ethernet CFM	73
Maintenance Domains	74
Maintenance Points	74
Maintenance End Points	75
Implementation Information	76
Configure CFM	76
Related Configuration Tasks	76
Enable Ethernet CFM	77
Create a Maintenance Domain	77
Create a Maintenance Association	78
Create Maintenance Points	78
Create a Maintenance End Point	78
Create a Maintenance Intermediate Point	79
MP Databases	79
MP Database Persistence	80
Continuity Check Messages	80
Enable CCM	81
Enable Cross-checking	82
Loopback Message and Response	82
Linktrace Message and Response	82
Link Trace Cache	83
Enable CFM SNMP Traps.	84
Display Ethernet CFM Statistics	85
802.1X	87
Protocol Overview	87
The Port-authentication Process	88
EAP over RADIUS	89
RADIUS Attributes for 802.1 Support	90
Configuring 802.1X	90
Related Configuration Tasks	90
Important Points to Remember	91
Enabling 802.1X	91
Configuring Request Identity Re-transmissions	92
Configuring a Quiet Period after a Failed Authentication	93
Forcibly Authorizing or Unauthorizing a Port	94
Re-authenticating a Port	95
Periodic Re-authentication	95
Configuring Timeouts	96
Dynamic VLAN Assignment with Port Authentication	98
Guest and Authentication-fail VLANs	99
Configuring a Guest VLAN	99
Configuring an Authentication-fail VLAN	100
Access Control Lists (ACLs)	103
Overview	103
IP Access Control Lists (ACLs)	104
CAM Profiling, CAM Allocation, and CAM Optimization	104
CAM Profiling	105
User Configurable CAM Allocation	105
CAM optimization	106
Test CAM Usage	106
Implementing ACLs on FTOS	107
ACLs and VLANs	107
ACL Optimization	107
Determine the order in which ACLs are used to classify traffic	107
IP Fragment Handling	108
IP fragments ACL examples	109
Layer 4 ACL rules examples	109
Configure a standard IP ACL	110
Configure an extended IP ACL	113
Configure filters with sequence number	113
Configure filters without sequence number	115
Established Flag	116
Configuring Layer 2 and Layer 3 ACLs on an Interface	116
Assign an IP ACL to an Interface	117
Counting ACL Hits	118
Configuring Ingress ACLs	119
Configuring Egress ACLs	119
Egress Layer 3 ACL Lookup for Control-plane IP Traffic	120
Configuring ACLs to Loopback	121
Applying an ACL on Loopback Interfaces	121
IP Prefix Lists	122
Implementation Information	123
Configuration Task List for Prefix Lists	123
Configure a prefix list	123
Use a prefix list for route redistribution	126
ACL Resequencing	127
Resequencing an ACL or Prefix List	128
Route Maps	130
Implementation Information	130
Important Points to Remember	130
Configuration Task List for Route Maps	130
Create a route map	131
Configure route map filters	132
Configure a route map for route redistribution	135
Configure a route map for route tagging	136
Continue clause	136
Bidirectional Forwarding Detection (BFD)	139
Protocol Overview	139
How BFD Works	140
BFD packet format	140
BFD sessions	142
BFD three-way handshake	143
Session state changes	144
Important Points to Remember	145
Configuring Bidirectional Forwarding Detection	145
Configuring BFD for Physical Ports	145
Related configuration tasks	146
Enabling BFD globally	146
Establishing a session on physical ports	146
Viewing physical port session parameters	148
Disabling and re-enabling BFD	149
Configuring BFD for Static Routes	149
Related configuration tasks	150
Establishing sessions for static routes	150
Changing static route session parameters	151
Disabling BFD for static routes	151
Configuring BFD for OSPF	151
Related configuration tasks	152
Establishing sessions with OSPF neighbors	152
Changing OSPF session parameters	153
Disabling BFD for OSPF	154
Configuring BFD for IS-IS	154
Related configuration tasks	154
Establishing sessions with IS-IS neighbors	154
Changing IS-IS session parameters	156
Disabling BFD for IS-IS	156
Configuring BFD for BGP	157
Prerequisites	157
Establishing sessions with BGP neighbors	157
Disabling BFD for BGP	159
Using BFD in a BGP Peer Group	160
Displaying BFD for BGP Information	160
Configuring BFD for VRRP	165
Related configuration tasks	165
Establishing sessions with all VRRP neighbors	165
Establishing VRRP sessions on VRRP neighbors	166
Changing VRRP session parameters	167
Disabling BFD for VRRP	168
Configuring BFD for VLANs	168
Related configuration tasks	169
Establishing sessions with VLAN neighbors	169
Disabling BFD for VLANs	169
Configuring BFD for Port-Channels	169
Related configuration tasks	170
Establishing sessions on port-channels	170
Disabling BFD for port-channels	170
Configuring Protocol Liveness	171
Troubleshooting BFD	171
Border Gateway Protocol	173
Protocol Overview	174
Autonomous Systems (AS)	174
Sessions and Peers	176
Establishing a session	177
Peer Groups	177
Route Reflectors	178
Confederations	179
Communities	179
BGP Attributes	179
Best Path Selection Criteria	179
Best Path selection details	181
Weight	182
Local Preference	182
Multi-Exit Discriminators (MEDs)	183
Origin	184
AS Path	185
Next Hop	186
Multiprotocol BGP	186
Implementing BGP with FTOS	186
Additional Path (Add-Path) support	186
Advertise IGP cost as MED for redistributed routes	187
Ignore Router-ID for some best-path calculations	187
4-Byte AS Numbers	188
AS4 Number Representation	188
Dynamic AS Number Notation application	189
AS Number Migration	191
BGP4 Management Information Base (MIB)	193
Important Points to Remember	193
Configuration Information	194
BGP Configuration	195
Defaults	195
Configuration Task List for BGP	196
Enable BGP	196
Configure AS4 Number Representations	201
Configure Peer Groups	203
BGP fast fall-over	207
Configure passive peering	209
Maintain existing AS numbers during an AS migration	210
Allow an AS number to appear in its own AS path	211
Enable graceful restart	212
Filter on an AS-Path attribute	214
Redistribute routes	217
Enable additional paths	218
Configure IP community lists	218
Manipulate the COMMUNITY attribute	221
Change MED attribute	224
Change LOCAL_PREFERENCE attribute	224
Change NEXT_HOP attribute	225
Change WEIGHT attribute	225
Enable multipath	226
Filter BGP routes	226
Configure BGP route reflectors	229
Aggregate routes	230
Configure BGP confederations	231
Enable route flap dampening	231
Change BGP timers	235
BGP neighbor soft-reconfiguration	235
Route map continue	237
MBGP Configuration	238
BGP Regular Expression Optimization	239
Debugging BGP	239
Storing Last and Bad PDUs	240
Capturing PDUs	241
PDU Counters	242
Sample Configurations	242
Bare Metal Provisioning 3.0 (BMP 3.0)	253
Overview	253
Prerequisites	254
Important Information	254
BMP Process Overview	254
Preparing BMP	255
DHCP Server	255
DHCP Configuration	255
DHCP Retry Mechanism	256
DHCP server IP Blacklist	256
MAC-Based IP assignment	256
File Server	257
Domain Name Server	257
Reload Modes	257
BMP Mode	258
BMP Mode Prerequisites	258
MAC-Based IP Address Assignment	258
Normal Mode	259
DHCP Configuration	259
FTOS Image Retrieval	259
Scripts	259
Pre-configuration Scripts	259
Post-configuration Scripts	260
Auto-execution Scripts	260
Process for pre-configuration scripts:	260
Configuration Tasks	261
System boot and set-up behavior in BMP Mode	262
BMP mode: Boot and Set-up Behavior	263
Reload without a DHCP Server Offer	264
Reload with a DHCP Server Offer without an FTOS Image	264
Reload with a DHCP Server Offer without a Configuration File	264
Reload with a DHCP Server Offer without a DNS Server	266
Reload with a Pre-configuration Script (BMP mode only)	266
Using the Post-Configuration Script (BMP mode only)	267
Reload using the Auto-execution Script (Normal mode only)	267
Script Examples	268
Auto-execution Script - Normal mode	268
Pre-configuration Script - BMP Mode	271
Content Addressable Memory (CAM)	273
Content Addressable Memory	273
CAM Profiles	274
Microcode	275
CAM Profiling for ACLs	276
Boot Behavior	277
Example: EF Line Card with EG Chassis Profile (Card Problem)	278
Example: EH Line Card with EG Chassis Profile (Card Problem)	278
When to Use CAM Profiling	278
Important Points to Remember	279
Differences Between EtherScale and TeraScale	279
Select CAM Profiles	279
CAM Allocation	280
Test CAM Usage	281
View CAM Profiles	281
View CAM-ACL settings	282
View CAM Usage	284
Configure IPv4Flow Sub-partitions	284
Configure Ingress Layer 2 ACL Sub-partitions	287
Return to the Default CAM Configuration	289
CAM Optimization	289
Applications for CAM Profiling	289
LAG Hashing	289
LAG Hashing based on Bidirectional Flow	290
CAM profile for the VLAN ACL group feature	290
Troubleshoot CAM Profiling	290
CAM Profile Mismatches	290
QoS CAM Region Limitation	291
Control Plane Policing (CoPP)	293
Overview	293
Configure Control Plane Policing	294
Configure CoPP for protocols	295
Sample Config for CoPP protocol configuration	296
Configure CoPP for CPU queues	297
Sample Config for CoPP CPU queue configuration	297
Show commands	298
Data Center Bridging (DCB)	301
Ethernet Enhancements in Data Center Bridging	301
Priority-Based Flow Control	302
Enhanced Transmission Selection	304
Data Center Bridging Exchange Protocol (DCBx)	305
Data Center Bridging in a Traffic Flow	305
Enabling Data Center Bridging	306
QoS dot1p Traffic Classification and Queue Assignment	307
Configuring Priority-Based Flow Control	308
Configuring Lossless Queues	311
Configuring the PFC Buffer in a Switch Stack	312
DCB and Switch Stacking Caveats for the S4820T	313
Configuring Enhanced Transmission Selection	313
ETS Prerequisites and Restrictions	313
Creating a QoS ETS Output Policy	314
Creating an ETS Priority Group	317
Applying an ETS Output Policy for a Priority Group to an Interface	318
ETS Operation with DCBx	319
Configuring Bandwidth Allocation for DCBx CIN	320
Applying DCB Policies in a Switch Stack	321
Configuring DCBx Operation	322
DCBx Operation	322
DCBx Port Roles	322
DCB Configuration Exchange	324
Configuration Source Election	324
Propagation of DCB Information	325
Auto-Detection and Manual Configuration of the DCBx Version	325
DCBx Example	326
DCBx Prerequisites and Restrictions	328
DCBx Configuration Procedure	328
Configuring DCBx on an Interface	328
Configuring DCBx Globally on the Switch	330
DCBx Error Messages	332
An error in DCBx operation is displayed using the syslog messages:	332
Debugging DCBx on an Interface	332
Verifying DCB Configuration	333
PFC and ETS Configuration Examples	346
Using PFC and ETS to Manage Data Center Traffic	346
Using PFC and ETS to Manage Converged Ethernet Traffic in a Switch Stack	350
Hierarchical Scheduling in ETS Output Policies	351
S-Series Debugging and Diagnostics	353
Offline diagnostics	353
Important Points to Remember	354
Running Offline Diagnostics	354
Trace logs	357
Auto Save on Crash or Rollover	358
Last restart reason	358
Hardware watchdog timer	358
show hardware commands	359
Environmental monitoring	360
Recognize an over-temperature condition	360
Troubleshoot an over-temperature condition	361
Recognize an under-voltage condition	361
Troubleshoot an under-voltage condition	362
Buffer tuning	362
Deciding to tune buffers	364
Buffer tuning commands	365
Using a pre-defined buffer profile	367
Sample buffer profile configuration	367
Troubleshooting packet loss	368
Displaying Drop Counters	368
Dataplane Statistics	370
Displaying Stack Port Statistics	372
Displaying Stack Member Counters	372
Application core dumps	373
Mini core dumps	373
TCP dumps	374
Dynamic Host Configuration Protocol (DHCP)	377
Protocol Overview	377
DHCP Packet Format and Options	378
Assigning an IP Address using DHCP	379
Implementation Information	380
Configuration Tasks	380
Configure the System to be a DHCP Server	380
Configuration Tasks	381
Related Configuration Tasks	381
Configure the Server for Automatic Address Allocation	381
Create an IP Address Pool	382
Exclude Addresses from the Address Pool	382
Specify an Address Lease Time	383
Specify a Default Gateway	383
Enable DHCP Server	383
Configure a Method of Hostname Resolution	384
Address Resolution using DNS	384
Address Resolution using NetBIOS WINS	384
Create Manual Binding Entries	384
Debug DHCP server	385
DHCP Clear Commands	385
Configure the System to be a Relay Agent	385
Configure the System for User Port Stacking	387
Configure Secure DHCP	387
Option 82	387
DHCP Snooping	388
Enable DCHP Snooping	389
Add a static entry in the binding table	389
Clear the binding table	389
Display the contents of the binding table	389
Drop DHCP packets on snooped VLANs only	390
Dynamic ARP Inspection	391
Bypass the ARP Inspection	393
Source Address Validation	393
IP Source Address Validation	393
DHCP MAC Source Address Validation	394
IP+MAC Source Address Validation	394
Equal Cost Multi-Path (ECMP)	397
ECMP for Flow-based Affinity	397
Configurable Hash Algorithm	397
Deterministic ECMP Next Hop	398
Configurable Hash Algorithm Seed	398
Link Bundle Monitoring	399
Managing ECMP Group Paths	400
Enabling FIPS Cryptography	401
Preparing the System	401
Enabling FIPS Mode	401
Generating Host-Keys	402
Monitoring FIPS Mode Status	403
Disabling the FIPS Mode	403
FIP Snooping	405
Fibre Channel over Ethernet	405
Ensuring Robustness in a Converged Ethernet Network	405
FIP Snooping on Ethernet Bridges	407
FIP Snooping in a Switch Stack	409
Configuring FIP Snooping	409
Enabling the FIP Snooping Feature	410
Enabling FIP Snooping on VLANs	410
Configuring the FC-MAP Value	410
Configuring a Port for a Bridge-to-Bridge Link	411
Configuring a Port for a Bridge-to-FCF Link	411
Impact on Other Software Features	411
FIP Snooping Prerequisites	411
FIP Snooping Restrictions	412
Configuration Procedure	412
Displaying FIP Snooping Information	413
FIP Snooping Configuration Example	418
Force10 Resilient Ring Protocol (FRRP)	421
Protocol Overview	421
Ring Status	422
Ring Checking	422
Ring Failure	422
Ring Restoration	422
Multiple FRRP Rings	423
Member VLAN Spanning Two Rings Connected by One Switch	423
Important FRRP Points	423
Important FRRP Concepts	424
Implementing FRRP	425
FRRP Configuration	425