Home » Dell Manuals » Servers » Dell Force10 S4820T » Manual Viewer

Dell Force10 S4820T S4820T Configuration Guide - Page 109

Access Control Lists (ACLs), Overview

View all Dell Force10 S4820T manuals

Add to My Manuals
Save this manual to your list of manuals

Page 109 highlights

7 Access Control Lists (ACLs) This chapter describes the Access Control Lists (ACLs), prefix lists, and route-maps. e c s Access Control Lists (ACLs) are supported on platforms: S4820T e c s Ingress IP and MAC ACLs are supported on platforms: S4820T e s Egress IP and MAC ACLs are supported on platforms: S4820T Overview At their simplest, Access Control Lists (ACLs), Prefix lists, and Route-maps permit or deny traffic based on MAC and/or IP addresses. This chapter discusses implementing IP ACLs, IP Prefix lists and Route-maps. For MAC ACLS, refer to Layer 2. An ACL is essentially a filter containing some criteria to match (examine IP, TCP, or UDP packets) and an action to take (permit or deny). ACLs are processed in sequence so that if a packet does not match the criterion in the first filter, the second filter (if configured) is applied. When a packet matches a filter, the switch drops or forwards the packet based on the filter's specified action. If the packet does not match any of the filters in the ACL, the packet is dropped ( implicit deny). The number of ACLs supported on a system depends on your CAM size. See CAM Profiling, CAM Allocation, and CAM Optimization in this chapter for more information. Refer to Content Addressable Memory (CAM) for complete CAM profiling information. This chapter covers the following topics: • IP Access Control Lists (ACLs) • CAM Profiling, CAM Allocation, and CAM Optimization • Implementing ACLs on FTOS • IP Fragment Handling • Configure a standard IP ACL • Configure an extended IP ACL • Configuring Layer 2 and Layer 3 ACLs on an Interface • Assign an IP ACL to an Interface • Configuring Ingress ACLs • Configuring Egress ACLs Access Control Lists (ACLs) | 109

Section	Page
About this Guide	29
Objectives	29
Audience	29
Conventions	29
Information Symbols	30
Related Documents	30
Configuration Fundamentals	33
Accessing the Command Line	33
CLI Modes	34
Navigating CLI Modes	35
The do Command	37
Undoing Commands	39
Obtaining Help	39
Entering and Editing Commands	40
Command History	41
Filtering show Command Outputs	41
Multiple Users in Configuration mode	44
Getting Started	45
Console access	45
Serial console	45
Accessing the RJ-45 console port with a DB-9 adapter	46
Default Configuration	47
Configure a Host Name	47
Access the System Remotely	47
Access the C-Series, E-Series, S4810, and the S4820T Remotely	48
Configure the Management Port IP Address	48
Configure a Management Route	48
Configure a Username and Password	49
Access the S-Series Remotely	49
Configure the Enable Password	50
Configuration File Management	51
Copy Files to and from the System	51
Important Points to Remember	52
Save the Running-configuration	52
Configure the Overload bit for Startup Scenario	53
View Files	54
View Configuration Files	55
File System Management	56
View command history	57
Upgrading FTOS	57
Management	59
Configure Privilege Levels	59
Create a Custom Privilege Level	59
Removing a command from EXEC mode	60
Move a command from EXEC privilege mode to EXEC mode	60
Allow Access to CONFIGURATION mode commands	60
Allow Access to INTERFACE, LINE, ROUTE-MAP, and ROUTER mode	60
Apply a Privilege Level to a Username	62
Apply a Privilege Level to a Terminal Line	62
Configure Logging	63
Log Messages in the Internal Buffer	63
Configuration Task List for System Log Management	63
Disable System Logging	63
Send System Messages to a Syslog Server	64
Configure a Unix System as a Syslog Server	64
Change System Logging Settings	64
Display the Logging Buffer and the Logging Configuration	65
Configure a UNIX logging facility level	66
Synchronize log messages	68
Enable timestamp on syslog messages	68
File Transfer Services	69
Configuration Task List for File Transfer Services	69
Enable FTP server	69
Configure FTP server parameters	69
Configure FTP client parameters	70
Terminal Lines	71
Deny and Permit Access to a Terminal Line	71
Configure Login Authentication for Terminal Lines	71
Time out of EXEC Privilege Mode	73
Telnet to Another Network Device	73
Lock CONFIGURATION mode	74
Viewing the Configuration Lock Status	75
Recovering from a Forgotten Password on the S4810 or S4820T	75
Recovering from a Forgotten Enable Password on the S4810 or S4820T	76
Recovering from a Failed Start on the S4810 or S4820T	76
802.1ag	79
Ethernet CFM	79
Maintenance Domains	80
Maintenance Points	80
Maintenance End Points	81
Implementation Information	82
Configure CFM	82
Related Configuration Tasks	82
Enable Ethernet CFM	83
Create a Maintenance Domain	83
Create a Maintenance Association	84
Create Maintenance Points	84
Create a Maintenance End Point	84
Create a Maintenance Intermediate Point	85
MP Databases	85
MP Database Persistence	86
Continuity Check Messages	86
Enable CCM	87
Enable Cross-checking	88
Loopback Message and Response	88
Linktrace Message and Response	88
Link Trace Cache	89
Enable CFM SNMP Traps.	90
Display Ethernet CFM Statistics	91
802.1X	93
Protocol Overview	93
The Port-authentication Process	94
EAP over RADIUS	95
RADIUS Attributes for 802.1 Support	96
Configuring 802.1X	97
Related Configuration Tasks	97
Important Points to Remember	97
Enabling 802.1X	97
Configuring Request Identity Re-transmissions	99
Configuring a Quiet Period after a Failed Authentication	100
Forcibly Authorizing or Unauthorizing a Port	101
Re-authenticating a Port	102
Periodic Re-authentication	102
Configuring Timeouts	103
Dynamic VLAN Assignment with Port Authentication	104
Guest and Authentication-fail VLANs	105
Configuring a Guest VLAN	106
Configuring an Authentication-fail VLAN	106
Access Control Lists (ACLs)	109
Overview	109
IP Access Control Lists (ACLs)	110
CAM Profiling, CAM Allocation, and CAM Optimization	110
CAM Profiling	111
User Configurable CAM Allocation	111
CAM optimization	112
Test CAM Usage	112
Implementing ACLs on FTOS	113
ACLs and VLANs	113
ACL Optimization	113
Determine the order in which ACLs are used to classify traffic	113
IP Fragment Handling	114
IP fragments ACL examples	115
Layer 4 ACL rules examples	115
Configure a standard IP ACL	116
Configure an extended IP ACL	118
Configure filters with sequence number	119
Configure filters without sequence number	121
Established Flag	122
Configuring Layer 2 and Layer 3 ACLs on an Interface	122
Assign an IP ACL to an Interface	123
Counting ACL Hits	124
Configuring Ingress ACLs	125
Configuring Egress ACLs	125
Egress Layer 3 ACL Lookup for Control-plane IP Traffic	126
Configuring ACLs to Loopback	127
Applying an ACL on Loopback Interfaces	127
IP Prefix Lists	128
Implementation Information	129
Configuration Task List for Prefix Lists	129
Configure a prefix list	129
Use a prefix list for route redistribution	132
ACL Resequencing	133
Resequencing an ACL or Prefix List	134
Route Maps	136
Implementation Information	136
Important Points to Remember	136
Configuration Task List for Route Maps	136
Create a route map	137
Configure route map filters	138
Configure a route map for route redistribution	141
Configure a route map for route tagging	142
Continue clause	142
Bidirectional Forwarding Detection (BFD)	145
Protocol Overview	145
How BFD Works	146
BFD packet format	146
BFD sessions	148
BFD three-way handshake	149
Session state changes	150
Important Points to Remember	151
Configuring Bidirectional Forwarding Detection	151
Configuring BFD for Physical Ports	151
Related configuration tasks	152
Enabling BFD globally	152
Establishing a session on physical ports	152
Viewing physical port session parameters	154
Disabling and re-enabling BFD	155
Configuring BFD for Static Routes	155
Related configuration tasks	156
Establishing sessions for static routes	156
Changing static route session parameters	157
Disabling BFD for static routes	157
Configuring BFD for OSPF	157
Related configuration tasks	158
Establishing sessions with OSPF neighbors	158
Changing OSPF session parameters	159
Disabling BFD for OSPF	160
Configuring BFD for IS-IS	160
Related configuration tasks	160
Establishing sessions with IS-IS neighbors	160
Changing IS-IS session parameters	162
Disabling BFD for IS-IS	162
Configuring BFD for BGP	163
Prerequisites	163
Establishing sessions with BGP neighbors	163
Disabling BFD for BGP	165
Using BFD in a BGP Peer Group	166
Displaying BFD for BGP Information	166
Configuring BFD for VRRP	171
Related configuration tasks	171
Establishing sessions with all VRRP neighbors	171
Establishing VRRP sessions on VRRP neighbors	172
Changing VRRP session parameters	173
Disabling BFD for VRRP	174
Configuring BFD for VLANs	174
Related configuration tasks	175
Establishing sessions with VLAN neighbors	175
Disabling BFD for VLANs	175
Configuring BFD for Port-Channels	175
Related configuration tasks	176
Establishing sessions on port-channels	176
Disabling BFD for port-channels	176
Configuring Protocol Liveness	177
Troubleshooting BFD	177
Border Gateway Protocol IPv4 (BGPv4)	179
Protocol Overview	180
Autonomous Systems (AS)	180
Sessions and Peers	182
Establishing a session	182
Peer Groups	183
Route Reflectors	183
Confederations	184
Communities	184
BGP Attributes	185
Best Path Selection Criteria	185
Best Path selection details	186
Weight	188
Local Preference	188
Multi-Exit Discriminators (MEDs)	188
Origin	189
AS Path	190
Next Hop	190
Multiprotocol BGP	191
Implementing BGP with FTOS	191
Additional Path (Add-Path) support	191
Advertise IGP cost as MED for redistributed routes	191
Ignore Router-ID for some best-path calculations	192
4-Byte AS Numbers	192
AS4 Number Representation	193
Dynamic AS Number Notation application	194
AS Number Migration	195
BGP4 Management Information Base (MIB)	197
Important Points to Remember	197
Configuration Information	198
BGP Configuration	199
Defaults	199
Configuration Task List for BGP	199
Enable BGP	200
Configure AS4 Number Representations	204
Configure Peer Groups	206
BGP fast fall-over	209
Configure passive peering	211
Maintain existing AS numbers during an AS migration	211
Allow an AS number to appear in its own AS path	213
Enable graceful restart	214
Filter on an AS-Path attribute	215
Redistribute routes	218
Enable additional paths	219
Configure IP community lists	219
Manipulate the COMMUNITY attribute	222
Change MED attribute	224
Change LOCAL_PREFERENCE attribute	224
Change NEXT_HOP attribute	225
Change WEIGHT attribute	226
Enable multipath	226
Filter BGP routes	227
Configure BGP route reflectors	230
Aggregate routes	230
Configure BGP confederations	231
Enable route flap dampening	232
Change BGP timers	235
BGP neighbor soft-reconfiguration	236
Route map continue	237
MBGP Configuration	238
BGP Regular Expression Optimization	239
Debugging BGP	239
Storing Last and Bad PDUs	240
Capturing PDUs	241
PDU Counters	243
Sample Configurations	243
Example: Enable BGP, Router 1	244
Example: Enable BGP, Router 2	245
Example: Enable BGP, Router 3	246
Example: Enable Peer Group, Router 1	247
Example: Enable Peer Groups, Router 1 (Continued)	248
Example: Enable Peer Groups, Router 2	249
Example: Enable Peer Groups, Router 3	250
Example: Enable Peer Groups, Router 3 (Continued)	251
Bare Metal Provisioning 2.0	253
Prerequisites	253
Restrictions	254
Overview	254
Jumpstart mode	255
DHCP Server	255
DHCP Configuration	255
MAC-Based IP assignment	256
DHCP Retry Mechanism	257
File Server	258
Domain Name Server	258
Switch boot and set-up behavior in Jumpstart Mode	258
Content Addressable Memory (CAM)	261
Content Addressable Memory	261
CAM Profiles	262
Microcode	263
CAM Profiling for ACLs	264
Boot Behavior	265
Example: EF Line Card with EG Chassis Profile (Card Problem)	266
Example: EH Line Card with EG Chassis Profile (Card Problem)	266
When to Use CAM Profiling	267
Important Points to Remember	267
Differences Between EtherScale and TeraScale	267
Select CAM Profiles	268
CAM Allocation	268
Test CAM Usage	269
View CAM Profiles	270
View CAM-ACL settings	271
View CAM Usage	272
Configure IPv4Flow Sub-partitions	273
Configure Ingress Layer 2 ACL Sub-partitions	276
Return to the Default CAM Configuration	278
CAM Optimization	278
Applications for CAM Profiling	278
LAG Hashing	278
LAG Hashing based on Bidirectional Flow	279
CAM profile for the VLAN ACL group feature	279
Troubleshoot CAM Profiling	279
CAM Profile Mismatches	279
QoS CAM Region Limitation	280
Control Plane Policing (CoPP)	281
Overview	281
Configure Control Plane Policing	282
Configure CoPP for protocols	283
Sample Config for CoPP protocol configuration	284
Configure CoPP for CPU queues	285
Sample Config for CoPP CPU queue configuration	285
Show commands	286
Data Center Bridging (DCB)	289
Ethernet Enhancements in Data Center Bridging	289
Priority-Based Flow Control	290
Enhanced Transmission Selection	292
Data Center Bridging Exchange Protocol (DCBx)	293
Data Center Bridging in a Traffic Flow	293
Enabling Data Center Bridging	294
QoS dot1p Traffic Classification and Queue Assignment	295
Configuring Priority-Based Flow Control	296
Configuring Lossless Queues	299
Configuring the PFC Buffer in a Switch Stack	300
DCB and Switch Stacking Caveats for the S4820T	301
Configuring Enhanced Transmission Selection	301
ETS Prerequisites and Restrictions	301
Creating a QoS ETS Output Policy	302
Creating an ETS Priority Group	305
Applying an ETS Output Policy for a Priority Group to an Interface	306
ETS Operation with DCBx	307
Configuring Bandwidth Allocation for DCBx CIN	308
Applying DCB Policies in a Switch Stack	309
Configuring DCBx Operation	310
DCBx Operation	310
DCBx Port Roles	310
DCB Configuration Exchange	312
Configuration Source Election	312
Propagation of DCB Information	313
Auto-Detection and Manual Configuration of the DCBx Version	313
DCBx Example	314
DCBx Prerequisites and Restrictions	316
DCBx Configuration Procedure	316
Configuring DCBx on an Interface	316
Configuring DCBx Globally on the Switch	318
DCBx Error Messages	320
An error in DCBx operation is displayed using the syslog messages:	320
Debugging DCBx on an Interface	320
Verifying DCB Configuration	321
PFC and ETS Configuration Examples	334
Using PFC and ETS to Manage Data Center Traffic	334
Using PFC and ETS to Manage Converged Ethernet Traffic in a Switch Stack	338
Hierarchical Scheduling in ETS Output Policies	339
Dynamic Host Configuration Protocol (DHCP)	341
Protocol Overview	341
DHCP Packet Format and Options	342
Assigning an IP Address using DHCP	343
Implementation Information	344
Configuration Tasks	344
Configure the System to be a DHCP Server	344
Configuration Tasks	345
Related Configuration Tasks	345
Configure the Server for Automatic Address Allocation	345
Create an IP Address Pool	346
Exclude Addresses from the Address Pool	346
Specify an Address Lease Time	347
Specify a Default Gateway	347
Enable DHCP Server	347
Configure a Method of Hostname Resolution	348
Address Resolution using DNS	348
Address Resolution using NetBIOS WINS	348
Create Manual Binding Entries	348
Debug DHCP server	349
DHCP Clear Commands	349
Configure the System to be a Relay Agent	349
Configure the System for User Port Stacking	351
Configure Secure DHCP	351
Option 82	351
DHCP Snooping	352
Enable DCHP snooping	353
Add a static entry in the binding table	353
Clear the binding table	353
Display the contents of the binding table	353
Drop DHCP packets on snooped VLANs only	354
Dynamic ARP Inspection	355
Bypass the ARP Inspection	357
Source Address Validation	357
IP Source Address Validation	357
DHCP MAC Source Address Validation	358
IP+MAC Source Address Validation	358
Equal Cost Multi-Path (ECMP)	361
ECMP for Flow-based Affinity	361
Configurable Hash Algorithm	361
Deterministic ECMP Next Hop	362
Configurable Hash Algorithm Seed	362
Link Bundle Monitoring	363
Managing ECMP Group Paths	364
Enabling FIPS Cryptography	365
Preparing the System	365
Enabling FIPS Mode	365
Generating Host-Keys	366
Monitoring FIPS Mode Status	367
Disabling the FIPS Mode	367
FIP Snooping	369
Fibre Channel over Ethernet	369
Ensuring Robustness in a Converged Ethernet Network	369
FIP Snooping on Ethernet Bridges	371
FIP Snooping in a Switch Stack	373
Configuring FIP Snooping	373
Enabling the FIP Snooping Feature	374
Enabling FIP Snooping on VLANs	374
Configuring the FC-MAP Value	374
Configuring a Port for a Bridge-to-Bridge Link	375
Configuring a Port for a Bridge-to-FCF Link	375
Impact on Other Software Features	375
FIP Snooping Prerequisites	375
FIP Snooping Restrictions	376
Configuration Procedure	376
Displaying FIP Snooping Information	377
FIP Snooping Configuration Example	382
Force10 Resilient Ring Protocol (FRRP)	385
Protocol Overview	385
Ring Status	386
Ring Checking	386
Ring Failure	386
Ring Restoration	386
Multiple FRRP Rings	387
Member VLAN Spanning Two Rings Connected by One Switch	387
Important FRRP Points	387
Important FRRP Concepts	388
Implementing FRRP	389
FRRP Configuration	390
Create the FRRP group	390
Configure the Control VLAN	390
Configure and add the Member VLANs	392
Set FRRP Timers	394
Clear FRRP counters	394
Show FRRP configuration	394
Show FRRP information	394
Troubleshooting FRRP	395
Configuration Checks	395
Sample Configuration and Topology	395
GARP VLAN Registration Protocol (GVRP)	397
Protocol Overview	397
Important Points to Remember	397
Configuring GVRP	398
Related Configuration Tasks	399
Enabling GVRP Globally	399
Enabling GVRP on a Layer 2 Interface	399
Configuring GVRP Registration	400
Configuring a GARP Timer	400
High Availability	403
Component Redundancy	404
RPM Redundancy	404
Boot the chassis with a single RPM	404
Boot the chassis with dual RPMs	404
Automatic and manual RPM failover	406
Communication between RPMs	406
Support for RPM redundancy by FTOS version	408
RPM synchronization	409
RPM redundancy configuration tasks	409
Online Insertion and Removal	410
RPM Online Insertion and Removal	410
Linecard Online Insertion and Removal	411
Pre-configure a line card slot	412
Replace a line card	412
Hitless Behavior	413
Graceful Restart	414
Software Resiliency	414
Runtime System Health Check	414
SFM Channel Monitoring	415
Software Component Health Monitoring	415
System Health Monitoring	415
Failure and Event Logging	415
Trace Log	416
Core Dumps	416
System Log	416