Dell Force10 S55T S55 Configuration Guide FTOS 8.3.5.3 - Page 105

• Loopback interfaces do not support ACLs using the IP fragment option. If you configure an ACL with the fragments option and apply it to a loopback interface, the command is accepted, but the ACL entries are not actually installed the offending rule in CAM. IP fragments ACL examples The following configuration permits all packets (both fragmented & non-fragmented) with destination IP 10.1.1.1. The second rule does not get hit at all. Force10(conf)#ip access-list extended ABC Force10(conf-ext-nacl)#permit ip any 10.1.1.1/32 Force10(conf-ext-nacl)#deny ip any 10.1.1.1./32 fragments Force10(conf-ext-nacl) To deny second/subsequent fragments, use the same rules in a different order. These ACLs deny all second & subsequent fragments with destination IP 10.1.1.1 but permit the first fragment & non fragmented packets with destination IP 10.1.1.1 . Force10(conf)#ip access-list extended ABC Force10(conf-ext-nacl)#deny ip any 10.1.1.1/32 fragments Force10(conf-ext-nacl)#permit ip any 10.1.1.1/32 Force10(conf-ext-nacl) Layer 4 ACL rules examples In the below scenario, first fragments non-fragmented TCP packets from 10.1.1.1 with TCP destination port equal to 24 are permitted. All other fragments are denied. Force10(conf)#ip access-list extended ABC Force10(conf-ext-nacl)#permit tcp host 10.1.1.1 any eq 24 Force10(conf-ext-nacl)#deny ip any any fragment Force10(conf-ext-nacl) In the following, TCP packets that are first fragments or non-fragmented from host 10.1.1.1 with TCP destination port equal to 24 are permitted. Additionally, all TCP non-first fragments from host 10.1.1.1 are permitted. All other IP packets that are non-first fragments are denied. Force10(conf)#ip access-list extended ABC Force10(conf-ext-nacl)#permit tcp host 10.1.1.1 any eq 24 Force10(conf-ext-nacl)#permit tcp host 10.1.1.1 any fragment Force10(conf-ext-nacl)#deny ip any any fragment Force10(conf-ext-nacl) Access Control Lists (ACL), Prefix Lists, and Route-maps | 105