Home » Dell Manuals » Servers » Dell Force10 E600i » Manual Viewer

Dell Force10 E600i FTOS Version 8.4.1.5 Configuration Guide for ExaScale - Page 132

IP Access Control Lists (ACLs), CAM Profiling, CAM Allocation, and CAM Optimization

Add to My Manuals
Save this manual to your list of manuals

Page 132 highlights

www.dell.com | support.dell.com IP Access Control Lists (ACLs) In the Dell Force10 switch/routers, you can create two different types of IP ACLs: standard or extended. A standard ACL filters packets based on the source IP packet. An extended ACL filters traffic based on the following criteria (for more information on ACL supported options refer to the FTOS Command Reference Guide): • IP protocol number • Source IP address • Destination IP address • Source TCP port number • Destination TCP port number • Source UDP port number • Destination UDP port number For extended ACL TCP and UDP filters, you can match criteria on specific or ranges of TCP or UDP ports. For extended ACL TCP filters, you can also match criteria on established TCP sessions. When creating an access list, the sequence of the filters is important. You have a choice of assigning sequence numbers to the filters as you enter them, or FTOS will assign numbers in the order the filters are created. The sequence numbers, whether configured or assigned by FTOS, are listed in the show config and show ip accounting access-list command display output. Ingress and egress Hot Lock ACLs allow you to append or delete new rules into an existing ACL (already written into CAM) without disrupting traffic flow. Existing entries in CAM are shuffled to accommodate the new entries. Hot Lock ACLs are enabled by default and support both standard and extended ACLs on all platforms. Note: Hot Lock ACLs are supported on Ingress ACLs only. CAM Profiling, CAM Allocation, and CAM Optimization e CAM Profiling is supported on platform c User Configurable CAM Allocations are supported on platform c s CAM optimization is supported on platforms CAM Profiling e CAM optimization is supported on platforms t CAM profiling for ACLs is supported on E-Series TeraScale only. For complete information regarding E-Series TeraScale CAM profiles and configuration, refer to Chapter 13, Content Addressable Memory. 132 | IP Access Control Lists (ACL), Prefix Lists, and Route-maps

Section	Page
About this Guide	33
Objectives	33
Audience	33
Conventions	33
Information Symbols	34
Related Documents	34
Configuration Fundamentals	35
Accessing the Command Line	35
CLI Modes	36
CLI Modes in FTOS	37
Navigating CLI Modes	38
The do Command	40
Undoing Commands	40
Obtaining Help	41
Entering and Editing Commands	42
Command History	43
Filtering show Command Outputs	43
Multiple Users in Configuration mode	44
Getting Started	45
Default Configuration	46
Configure a Host Name	46
Access the System Remotely	47
Access the C-Series and E-Series Remotely	47
Access the S-Series Remotely	49
Configure the Enable Password	49
Configuration File Management	50
Copy Files to and from the System	50
Save the Running-configuration	52
View Files	53
File System Management	55
View command history	56
Upgrading FTOS	56
System Management	57
Configure Privilege Levels	57
Create a Custom Privilege Level	57
Apply a Privilege Level to a Username	60
Apply a Privilege Level to a Terminal Line	60
Configure Logging	61
Log Messages in the Logging Buffer	61
Configuration Task List for System Log Management	61
Disable System Logging	62
Send System Messages to a Syslog Server	62
Configure a Unix System as a Syslog Server	62
Change System Logging Settings	63
Display the Logging Buffer and the Logging Configuration	64
Configure a UNIX Logging Facility Level	65
Synchronize Log Messages	66
Enable Timestamp on Syslog Messages	66
File Transfer Services	67
Configuration Task List for File Transfer Services	67
Terminal Lines	68
Deny and Permit Access to a Terminal Line	68
Configure Login Authentication for Terminal Lines	69
Time out of EXEC Privilege Mode	70
Telnet to Another Network Device	71
Lock CONFIGURATION mode	71
Viewing the Configuration Lock Status	72
Recovering from a Forgotten Password	73
Recovering from a Forgotten Enable Password	74
Recovering from a Forgotten Password on S-Series	75
Recovering from a Failed Start	76
802.1ag	79
Ethernet CFM	79
Maintenance Domains	80
Maintenance Points	80
Maintenance End Points	81
Implementation Information	82
Configure CFM	82
Related Configuration Tasks	82
Enable Ethernet CFM	82
Create a Maintenance Domain	83
Create a Maintenance Association	83
Create Maintenance Points	84
Create a Maintenance End Point	84
Create a Maintenance Intermediate Point	85
MP Databases	85
Continuity Check Messages	86
Enable CCM	87
Enable Cross-checking	87
Loopback Message and Response	87
Linktrace Message and Response	88
Link Trace Cache	88
Enable CFM SNMP Traps.	89
Display Ethernet CFM Statistics	91
802.3ah	93
Link Layer OAM Overview	93
Link Layer OAMPDUs	94
Link Layer OAM Operational Modes	95
Link Layer OAM Discovery	95
Link Layer OAM Events	96
Remote Loopback	96
Implementation Information	96
Configure Link Layer OAM	97
Related Configuration Tasks	97
Enable Link Layer OAM	97
Adjust the OAMPDU Transmission Parameters	98
Link Performance Event Monitoring	98
Enable Error Monitoring	99
Set Threshold Values	99
Execute an Action upon Exceeding the High Threshold	101
Remote Failure Indication	101
Remote Loopback	102
Display Link Layer OAM Configuration and Statistics	103
Manage Link Layer OAM	105
Enable MIB Retrieval Support/Function	105
Adjust the Size of the Link OAM Event Log	105
802.1X	107
Protocol Overview	107
The Port-authentication Process	109
EAP over RADIUS	110
Configuring 802.1X	111
Related Configuration Tasks	111
Important Points to Remember	112
Enabling 802.1X	112
Configuring Request Identity Re-transmissions	114
Configuring a Quiet Period after a Failed Authentication	115
Forcibly Authorizing or Unauthorizing a Port	116
Re-Authenticating a Port	117
Periodic Re-Authentication	117
Configuring Timeouts	118
Dynamic VLAN Assignment with Port Authentication	119
Guest and Authentication-Fail VLANs	120
Configuring a Guest VLAN	120
Configuring an Authentication-Fail VLAN	121
Multi-Host Authentication	122
Multi-Supplicant Authentication	124
MAC Authentication Bypass	126
MAB in Single-host and Multi-Host Mode	127
MAB in Multi-Supplicant Authentication Mode	127
Dynamic CoS with 802.1X	129
IP Access Control Lists (ACL), Prefix Lists, and Route-maps	131
Overview	131
IP Access Control Lists (ACLs)	132
CAM Profiling, CAM Allocation, and CAM Optimization	132
Implementing ACLs on FTOS	135
IP Fragment Handling	136
Configure a standard IP ACL	138
Configure an extended IP ACL	141
Configuring Layer 2 and Layer 3 ACLs on an Interface	144
Assign an IP ACL to an Interface	145
Counting ACL Hits	146
Configuring Ingress ACLs	146
Configuring Egress ACLs	147
Egress Layer 3 ACL Lookup for Control-plane IP Traffic	148
Configuring ACLs to Loopback	148
Applying an ACL on Loopback Interfaces	149
IP Prefix Lists	150
Implementation Information	150
Configuration Task List for Prefix Lists	151
ACL Resequencing	154
Resequencing an ACL or Prefix List	155
Route Maps	157
Implementation Information	157
Important Points to Remember	157
Configuration Task List for Route Maps	158
Bidirectional Forwarding Detection	165
Protocol Overview	165
How BFD Works	166
Important Points to Remember	171
Configuring Bidirectional Forwarding Detection	171
Configuring BFD for Physical Ports	171
Configuring BFD for Static Routes	175
Configuring BFD for OSPF	177
Configuring BFD for IS-IS	180
Configuring BFD for VRRP	182
Configuring BFD for VLANs	186
Configuring BFD for Port-Channels	188
Configuring Protocol Liveness	190
Troubleshooting BFD	190
Border Gateway Protocol IPv4 (BGPv4)	191
Protocol Overview	192
Autonomous Systems (AS)	192
Sessions and Peers	195
Route Reflectors	196
Confederations	197
BGP Attributes	197
Best Path Selection Criteria	197
Weight	200
Local Preference	200
Multi-Exit Discriminators (MEDs)	201
Origin	202
AS Path	202
Next Hop	203
Multiprotocol BGP	203
Implementing BGP with FTOS	203
Additional Path (Add-Path) support	203
4-Byte AS Numbers	205
AS4 Number Representation	205
AS Number Migration	207
BGP4 Management Information Base (MIB)	209
Important Points to Remember	209
Configuration Information	210
BGP Configuration	211
Configuration Task List for BGP	212
MBGP Configuration	249
BGP Regular Expression Optimization	250
Retain NH in BGP Advertisement	250
Debugging BGP	250
Storing Last and Bad PDUs	251
Capturing PDUs	252
PDU Counters	254
Sample Configurations	254
Content Addressable Memory	265
Content Addressable Memory	266
CAM Profiles	266
Microcode	268
CAM Profiling for ACLs	269
Boot Behavior	270
When to Use CAM Profiling	271
Important Points to Remember	271
Select CAM Profiles	272
CAM Allocation	273
Test CAM Usage	274
View CAM Profiles	274
View CAM-ACL settings	275
View CAM Usage	276
Configure IPv4Flow Sub-partitions	276
Configure Ingress Layer 2 ACL Sub-partitions	278
Return to the Default CAM Configuration	280
CAM Optimization	281
Applications for CAM Profiling	281
LAG Hashing	281
LAG Hashing based on Bidirectional Flow	281
CAM profile for the VLAN ACL group feature	281
Troubleshoot CAM Profiling	282
CAM Profile Mismatches	282
QoS CAM Region Limitation	282
Content Addressable Memory for ExaScale	285
Content Addressable Memory	285
Static Random Access Memory	286
CAM-profile templates	286
Default CAM-profile	288
Recommended CAM-profile templates	288
CAM/SRAM region minimums and maximums	290
Microcode	291
Boot Behavior	292
Select a CAM-profile template	292
Select pre-defined CAM-profile template	293
Create new CAM-profile	294
Assign a microcode to the CAM-profile template	295
Validate CAM-profile templates	295
Show CAM-profile templates	295
Configuration Replace and Rollback	299
Archived Files	299
Configuring Configuration Replace and Rollback	300
Related Configuration Tasks	300
Important Points to Remember	300
Enabling the Archive Service	300
Archiving a Configuration File	301
Viewing the Archive Directory	301
Replacing the Current Running Configuration	302
Rolling Back to the Previous Configuration	302
Configuring an Archive File Maximum	303
Configuring Auto-archive	304
Copying and Deleting an Archive File	305
Viewing and Editing the Contents of an Archive File	305
Viewing the Difference between Configuration Files	306
Dynamic Host Configuration Protocol	307
Protocol Overview	307
DHCP Packet Format and Options	307
Assigning an IP Address using DHCP	309
Implementation Information	310
Configuration Tasks	310
Configure the System to be a DHCP Server	310
Configuration Tasks	311
Configure the Server for Automatic Address Allocation	311
Specify a Default Gateway	313
Enable DHCP Server	313
Configure a Method of Hostname Resolution	314
Create Manual Binding Entries	314
Debug DHCP server	315
DHCP Clear Commands	315
Configure the System to be a Relay Agent	316
Configure Secure DHCP	317
Option 82	317
DHCP Snooping	318
Drop DHCP packets on snooped VLANs only	320
Dynamic ARP Inspection	320
Source Address Validation	322
Equal Cost Multi-Path	325
ECMP for Flow-based Affinity	325
Configurable Hash Algorithm	325
Deterministic ECMP Next Hop	325
Configurable Hash Algorithm Seed	326
Force10 Resilient Ring Protocol	329
Protocol Overview	329
Ring Status	330
Multiple FRRP Rings	331
Important FRRP Points	332
Important FRRP Concepts	333
Implementing FRRP	334
FRRP Configuration	335
Troubleshooting FRRP	339
Configuration Checks	339
Sample Configuration and Topology	339
Force10 Service Agent	343
Implementation Information	343
Configure Force10 Service Agent	344
Related Configuration Tasks	344
Enable Force10 Service Agent	344
Specify an SMTP Server for FTSA	345
Provide an Administrator E-mail Address	345
FTSA Messaging Service	346
Enable the FTSA Messaging Service	346
Add Additional Recipients of FTSA E-mails	347
Encrypt FTSA Messages	348
Provide Administrator Contact Information	348
Set the Frequency of FTSA Type 3 Messages	349
Generate FTSA Type 4 Messages	349
Set Parameters FTSA Type 5 Messages	349
FTSA Message Types	350
FTSA Policies	352
Create an FTSA Policy Test List	353
Create a Policy Action List	355
Create a Policy and Assign a Test and Action List	358
Additional Policy Configurations	358
FTSA Policy Sample Configurations	359
Debugging FTSA	365
GARP VLAN Registration Protocol	367
Protocol Overview	367
Important Points to Remember	367
Configuring GVRP	368
Related Configuration Tasks	369
Enabling GVRP Globally	369
Enabling GVRP on a Layer 2 Interface	369
Configuring GVRP Registration	370
Configuring a GARP Timer	371
High Availability	373
Component Redundancy	374
RPM Redundancy	374
Online Insertion and Removal	381
RPM Online Insertion and Removal	381
Line Card Online Insertion and Removal	382
Hitless Behavior	384
Graceful Restart	384
Software Resiliency	385
Runtime System Health Check	385
SFM Channel Monitoring	385
Software Component Health Monitoring	386
System Health Monitoring	386
Failure and Event Logging	386
Hot-lock Behavior	387
Warm Upgrade	388
Configure Cache Boot	388
In-Service Modular Hot-Fixes	392
Process Restartability	393
Internet Group Management Protocol	397
IGMP Implementation Information	397
IGMP Protocol Overview	397
IGMP version 2	398
IGMP version 3	399
Configuring IGMP	402
Related Configuration Tasks	402
Viewing IGMP Enabled Interfaces	403
Selecting an IGMP Version	403
Viewing IGMP Groups	404
Adjusting Timers	404
Adjusting Query and Response Timers	404
Adjusting the IGMP Querier Timeout Value	405
Configuring a Static IGMP Group	405
Enabling IGMP Immediate-leave	405
IGMP Snooping	406
IGMP Snooping Implementation Information	406
Configuring IGMP Snooping	406
Enabling IGMP Immediate-leave	407
Disabling Multicast Flooding	407
Specifying a Port as Connected to a Multicast Router	407
Configuring the Switch as Querier	408
Fast Convergence after MSTP Topology Changes	408
Designating a Multicast Router Interface	409
Interfaces	411
Interface Types	412
View Basic Interface Information	412
Enable a Physical Interface	414
Physical Interfaces	414
Configuration Task List for Physical Interfaces	415
Overview of Layer Modes	415
Configure Layer 2 (Data Link) Mode	416
Configure Layer 3 (Network) Mode	416
Management Interfaces	418
Configure Management Interfaces on the E-Series and C-Series	418
Configure Management Interfaces on the S-Series	419
Displaying Information on a Management Interface	420
VLAN Interfaces	421
Loopback Interfaces	422
Null Interfaces	422
Port Channel Interfaces	423
Bulk Configuration	434
Interface Range	434
Bulk Configuration Examples	435
Interface Range Macros	436
Define the Interface Range	436
Choose an Interface-range Macro	437
Monitor and Maintain Interfaces	437
Maintenance using TDR	438
Link Debounce Timer	439
Important Points to Remember about Link Debounce Timer	439
Assign a debounce time to an interface	440
Show debounce times in an interface	440
Disable ports when one only SFM is available (E300 only)	440
Disable port on one SFM	441
Link Dampening	441
Important Points to Remember	441
Enable Link Dampening	441
Ethernet Pause Frames	443
Threshold Settings	444
Enable Pause Frames	444
Configure MTU Size on an Interface	445
Port-pipes	446
Auto-Negotiation on Ethernet Interfaces	447
View Advanced Interface Information	450
Display Only Configured Interfaces	450
Configure Interface Sampling Size	451
Dynamic Counters	452
IPv4 Addressing	455
IP Addresses	456
Implementation Information	456
Configuration Task List for IP Addresses	456
Directed Broadcast	460
Resolution of Host Names	460
ARP	463
Configuration Task List for ARP	463
ARP Learning via Gratuitous ARP	466
ARP Learning via ARP Request	466
Configurable ARP Retries	467
ICMP	468
Configuration Task List for ICMP	468
UDP Helper	469
Configuring UDP Helper	469
Important Points to Remember about UDP Helper	469
Enabling UDP Helper	470
Configuring a Broadcast Address	470
Configurations Using UDP Helper	471
UDP Helper with Broadcast-all Addresses	471
UDP Helper with Subnet Broadcast Addresses	472
UDP Helper with Configured Broadcast Addresses	472
UDP Helper with No Configured Broadcast Addresses	473
Troubleshooting UDP Helper	473
IPv6 Addressing	475
Protocol Overview	476
Extended Address Space	476
Stateless Autoconfiguration	476
IPv6 Headers	477
Extension Header fields	479
Addressing	481
Implementing IPv6 with FTOS	482
ICMPv6	484
Path MTU Discovery	485
IPv6 Neighbor Discovery	486
IPv6 Neighbor Discovery of MTU packets	486
Advertise Neighbor Prefixes	487
QoS for IPv6	487
IPv6 Multicast	487
SSH over an IPv6 Transport	488
Configuration Task List for IPv6	488
Change your CAM-Profile on an E-Series system	489
Adjust your CAM-Profile on an C-Series or S-Series	490
Assign an IPv6 Address to an Interface	491
Assign a Static IPv6 Route	491
Telnet with IPv6	492
SNMP over IPv6	492
Show IPv6 Information	492
Show an IPv6 Interface	493
Show IPv6 Routes	494
Show the Running-Configuration for an Interface	496
Clear IPv6 Routes	496
Intermediate System to Intermediate System	497
Protocol Overview	498
IS-IS Addressing	498
Multi-Topology IS-IS	499
Transition Mode	500
Interface support	500
Adjacencies	500
Graceful Restart	500
Implementation Information	501
Configuration Information	502
Configuration Task List for IS-IS	503
Configuring the distance of a route	512
Change the IS-type	512
IS-IS Metric Styles	520
Configure Metric Values	520
Maximum Values in the Routing Table	520
Changing the IS-IS Metric Style in One Level Only	521
Leaking from One Level to Another	522
Sample Configuration	523
Link Aggregation Control Protocol	529
Introduction to Dynamic LAGs and LACP	529
Important Points to Remember	530
LACP modes	531
LACP Configuration Commands	531
LACP Configuration Tasks	532
Monitor and Debugging LACP	534
Shared LAG State Tracking	534
Configure Shared LAG State Tracking	535
Important Points about Shared LAG State Tracking	536
Configure LACP as Hitless	536
LACP Basic Configuration Example	537
Layer 2	545
Managing the MAC Address Table	545
Clear the MAC Address Table	545