Dell Force10 S55T S55 Configuration Guide FTOS 8.3.5.3 - Page 115

Configuring Egress ACLs e Egress ACLs are supported on platforms and the Egress ACLs are applied to line cards and affect the traffic leaving the system. Configuring egress ACLs onto physical interfaces protects the system infrastructure from attack-malicious and incidental-by explicitly allowing only authorized traffic.These system-wide ACLs eliminate the need to apply ACLs onto each interface and achieves the same results. By localizing target traffic, it is a simpler implementation. An egress ACL is used when users would like to restrict egress traffic. For example, when a DOS attack traffic is isolated to one particular interface, you can apply an egress ACL to block that particular flow from exiting the box, thereby protecting downstream devices. To create an egress ACLs, use the ip access-group command (Figure 234) in the EXEC Privilege mode. This example also shows viewing the configuration, applying rules to the newly created access group, and viewing the access list: Figure 7-11. Creating an Egress ACL Force10(conf)#interface gige 0/0 Force10(conf-if-gige0/0)#ip access-group abcd out Force10(conf-if-gige0/0)#show config Use the "out" keyword to specify egress. ! gigethernet 0/0 no ip address ip access-group abcd out no shutdown Force10(conf-if-gige0/0)#end Force10#configure terminal Begin applying rules to Force10(conf)#ip access-list extended abcd Force10(config-ext-nacl)#permit tcp any any Force10(config-ext-nacl)#deny icmp any any the ACL named "abcd." Force10(config-ext-nacl)#permit 1.1.1.2 Force10(config-ext-nacl)#end Force10#show ip accounting access-list View the access-list. ! Extended Ingress IP access list abcd on gigethernet 0/0 seq 5 permit tcp any any seq 10 deny icmp any any seq 15 permit 1.1.1.2 Access Control Lists (ACL), Prefix Lists, and Route-maps | 115