Dell Force10 MXL Blade MXL 10/40GbE Switch IO Module Configuration Guide - Page 86

www.dell.com | support.dell.com Configuring Egress ACLs Configuring egress ACLs onto physical interfaces protects the system infrastructure from attack- malicious and incidental-by explicitly allowing only authorized traffic.These system-wide ACLs eliminate the need to apply ACLs onto each interface and achieves the same results. By localizing target traffic, it is a simpler implementation. Use an egress ACL when you would like to restrict egress traffic. For example, when a DOS attack traffic is isolated to one particular interface, you can apply an egress ACL to block that particular flow from exiting the box, thereby protecting downstream devices. To create an egress ACLs, use the ip access-group command in EXEC Privilege mode (Figure 5-14). This example also shows viewing the configuration, applying rules to the newly created access group, and viewing the access list. Figure 5-14. Creating an Egress ACL FTOS(conf)#interface tengig 0/0 FTOS(conf-if-tengig0/0)#ip access-group abcd out FTOS(conf-if-tengig0/0)#show config Use the "out" keyword to specify egress. ! tengigethernet 0/0 no ip address ip access-group abcd out no shutdown FTOS(conf-if-tengig0/0)#end FTOS#configure terminal Begin applying rules to FTOS(conf)#ip access-list extended abcd FTOS(conf-ext-nacl)#permit tcp any any FTOS(conf-ext-nacl)#deny icmp any any the ACL named "abcd." FTOS(conf-ext-nacl)#permit 1.1.1.2 FTOS(conf-ext-nacl)#end FTOS#show ip accounting access-list View the access-list. ! Extended Ingress IP access list abcd on tengigethernet 0/0 seq 5 permit tcp any any seq 10 deny icmp any any seq 15 permit 1.1.1.2 Egress Layer 3 ACL Lookup for Control-Plane IP Traffic By default, packets originated from the system are not filtered by egress ACLs. If you initiate a ping session from the system, for example, and apply an egress ACL to block this type of traffic on the interface, the ACL does not affect that ping traffic. 84 | Access Control Lists (ACLs)