Home » Dell Manuals » Servers » Dell Force10 S4820T » Manual Viewer

Dell Force10 S4820T S4820T Configuration Guide - Page 115

IP fragments ACL examples, Layer 4 ACL rules examples

View all Dell Force10 S4820T manuals

Add to My Manuals
Save this manual to your list of manuals

Page 115 highlights

• Loopback interfaces do not support ACLs using the IP fragment option. If you configure an ACL with the fragments option and apply it to a loopback interface, the command is accepted, but the ACL entries are not actually installed the offending rule in CAM. IP fragments ACL examples The following configuration permits all packets (both fragmented & non-fragmented) with destination IP 10.1.1.1. The second rule does not get hit at all. FTOS(conf)#ip access-list extended ABC FTOS(conf-ext-nacl)#permit ip any 10.1.1.1/32 FTOS(conf-ext-nacl)#deny ip any 10.1.1.1./32 fragments FTOS(conf-ext-nacl) To deny second/subsequent fragments, use the same rules in a different order. These ACLs deny all second & subsequent fragments with destination IP 10.1.1.1 but permit the first fragment & non fragmented packets with destination IP 10.1.1.1. FTOS(conf)#ip access-list extended ABC FTOS(conf-ext-nacl)#deny ip any 10.1.1.1/32 fragments FTOS(conf-ext-nacl)#permit ip any 10.1.1.1/32 FTOS(conf-ext-nacl) Layer 4 ACL rules examples In the below scenario, first fragments non-fragmented TCP packets from 10.1.1.1 with TCP destination port equal to 24 are permitted. All other fragments are denied. FTOS(conf)#ip access-list extended ABC FTOS(conf-ext-nacl)#permit tcp host 10.1.1.1 any eq 24 FTOS(conf-ext-nacl)#deny ip any any fragment FTOS(conf-ext-nacl) In the following, TCP packets that are first fragments or non-fragmented from host 10.1.1.1 with TCP destination port equal to 24 are permitted. Additionally, all TCP non-first fragments from host 10.1.1.1 are permitted. All other IP packets that are non-first fragments are denied. FTOS(conf)#ip access-list extended ABC FTOS(conf-ext-nacl)#permit tcp host 10.1.1.1 any eq 24 FTOS(conf-ext-nacl)#permit tcp host 10.1.1.1 any fragment FTOS(conf-ext-nacl)#deny ip any any fragment FTOS(conf-ext-nacl) To log all the packets denied and to override the implicit deny rule and the implicit permit rule for TCP/ UDP fragments, use a configuration similar to the following. FTOS(conf)#ip access-list extended ABC FTOS(conf-ext-nacl)#permit tcp any any fragment FTOS(conf-ext-nacl)#permit udp any any fragment FTOS(conf-ext-nacl)#deny ip any any log Access Control Lists (ACLs) | 115

Section	Page
About this Guide	29
Objectives	29
Audience	29
Conventions	29
Information Symbols	30
Related Documents	30
Configuration Fundamentals	33
Accessing the Command Line	33
CLI Modes	34
Navigating CLI Modes	35
The do Command	37
Undoing Commands	39
Obtaining Help	39
Entering and Editing Commands	40
Command History	41
Filtering show Command Outputs	41
Multiple Users in Configuration mode	44
Getting Started	45
Console access	45
Serial console	45
Accessing the RJ-45 console port with a DB-9 adapter	46
Default Configuration	47
Configure a Host Name	47
Access the System Remotely	47
Access the C-Series, E-Series, S4810, and the S4820T Remotely	48
Configure the Management Port IP Address	48
Configure a Management Route	48
Configure a Username and Password	49
Access the S-Series Remotely	49
Configure the Enable Password	50
Configuration File Management	51
Copy Files to and from the System	51
Important Points to Remember	52
Save the Running-configuration	52
Configure the Overload bit for Startup Scenario	53
View Files	54
View Configuration Files	55
File System Management	56
View command history	57
Upgrading FTOS	57
Management	59
Configure Privilege Levels	59
Create a Custom Privilege Level	59
Removing a command from EXEC mode	60
Move a command from EXEC privilege mode to EXEC mode	60
Allow Access to CONFIGURATION mode commands	60
Allow Access to INTERFACE, LINE, ROUTE-MAP, and ROUTER mode	60
Apply a Privilege Level to a Username	62
Apply a Privilege Level to a Terminal Line	62
Configure Logging	63
Log Messages in the Internal Buffer	63
Configuration Task List for System Log Management	63
Disable System Logging	63
Send System Messages to a Syslog Server	64
Configure a Unix System as a Syslog Server	64
Change System Logging Settings	64
Display the Logging Buffer and the Logging Configuration	65
Configure a UNIX logging facility level	66
Synchronize log messages	68
Enable timestamp on syslog messages	68
File Transfer Services	69
Configuration Task List for File Transfer Services	69
Enable FTP server	69
Configure FTP server parameters	69
Configure FTP client parameters	70
Terminal Lines	71
Deny and Permit Access to a Terminal Line	71
Configure Login Authentication for Terminal Lines	71
Time out of EXEC Privilege Mode	73
Telnet to Another Network Device	73
Lock CONFIGURATION mode	74
Viewing the Configuration Lock Status	75
Recovering from a Forgotten Password on the S4810 or S4820T	75
Recovering from a Forgotten Enable Password on the S4810 or S4820T	76
Recovering from a Failed Start on the S4810 or S4820T	76
802.1ag	79
Ethernet CFM	79
Maintenance Domains	80
Maintenance Points	80
Maintenance End Points	81
Implementation Information	82
Configure CFM	82
Related Configuration Tasks	82
Enable Ethernet CFM	83
Create a Maintenance Domain	83
Create a Maintenance Association	84
Create Maintenance Points	84
Create a Maintenance End Point	84
Create a Maintenance Intermediate Point	85
MP Databases	85
MP Database Persistence	86
Continuity Check Messages	86
Enable CCM	87
Enable Cross-checking	88
Loopback Message and Response	88
Linktrace Message and Response	88
Link Trace Cache	89
Enable CFM SNMP Traps.	90
Display Ethernet CFM Statistics	91
802.1X	93
Protocol Overview	93
The Port-authentication Process	94
EAP over RADIUS	95
RADIUS Attributes for 802.1 Support	96
Configuring 802.1X	97
Related Configuration Tasks	97
Important Points to Remember	97
Enabling 802.1X	97
Configuring Request Identity Re-transmissions	99
Configuring a Quiet Period after a Failed Authentication	100
Forcibly Authorizing or Unauthorizing a Port	101
Re-authenticating a Port	102
Periodic Re-authentication	102
Configuring Timeouts	103
Dynamic VLAN Assignment with Port Authentication	104
Guest and Authentication-fail VLANs	105
Configuring a Guest VLAN	106
Configuring an Authentication-fail VLAN	106
Access Control Lists (ACLs)	109
Overview	109
IP Access Control Lists (ACLs)	110
CAM Profiling, CAM Allocation, and CAM Optimization	110
CAM Profiling	111
User Configurable CAM Allocation	111
CAM optimization	112
Test CAM Usage	112
Implementing ACLs on FTOS	113
ACLs and VLANs	113
ACL Optimization	113
Determine the order in which ACLs are used to classify traffic	113
IP Fragment Handling	114
IP fragments ACL examples	115
Layer 4 ACL rules examples	115
Configure a standard IP ACL	116
Configure an extended IP ACL	118
Configure filters with sequence number	119
Configure filters without sequence number	121
Established Flag	122
Configuring Layer 2 and Layer 3 ACLs on an Interface	122
Assign an IP ACL to an Interface	123
Counting ACL Hits	124
Configuring Ingress ACLs	125
Configuring Egress ACLs	125
Egress Layer 3 ACL Lookup for Control-plane IP Traffic	126
Configuring ACLs to Loopback	127
Applying an ACL on Loopback Interfaces	127
IP Prefix Lists	128
Implementation Information	129
Configuration Task List for Prefix Lists	129
Configure a prefix list	129
Use a prefix list for route redistribution	132
ACL Resequencing	133
Resequencing an ACL or Prefix List	134
Route Maps	136
Implementation Information	136
Important Points to Remember	136
Configuration Task List for Route Maps	136
Create a route map	137
Configure route map filters	138
Configure a route map for route redistribution	141
Configure a route map for route tagging	142
Continue clause	142
Bidirectional Forwarding Detection (BFD)	145
Protocol Overview	145
How BFD Works	146
BFD packet format	146
BFD sessions	148
BFD three-way handshake	149
Session state changes	150
Important Points to Remember	151
Configuring Bidirectional Forwarding Detection	151
Configuring BFD for Physical Ports	151
Related configuration tasks	152
Enabling BFD globally	152
Establishing a session on physical ports	152
Viewing physical port session parameters	154
Disabling and re-enabling BFD	155
Configuring BFD for Static Routes	155
Related configuration tasks	156
Establishing sessions for static routes	156
Changing static route session parameters	157
Disabling BFD for static routes	157
Configuring BFD for OSPF	157
Related configuration tasks	158
Establishing sessions with OSPF neighbors	158
Changing OSPF session parameters	159
Disabling BFD for OSPF	160
Configuring BFD for IS-IS	160
Related configuration tasks	160
Establishing sessions with IS-IS neighbors	160
Changing IS-IS session parameters	162
Disabling BFD for IS-IS	162
Configuring BFD for BGP	163
Prerequisites	163
Establishing sessions with BGP neighbors	163
Disabling BFD for BGP	165
Using BFD in a BGP Peer Group	166
Displaying BFD for BGP Information	166
Configuring BFD for VRRP	171
Related configuration tasks	171
Establishing sessions with all VRRP neighbors	171
Establishing VRRP sessions on VRRP neighbors	172
Changing VRRP session parameters	173
Disabling BFD for VRRP	174
Configuring BFD for VLANs	174
Related configuration tasks	175
Establishing sessions with VLAN neighbors	175
Disabling BFD for VLANs	175
Configuring BFD for Port-Channels	175
Related configuration tasks	176
Establishing sessions on port-channels	176
Disabling BFD for port-channels	176
Configuring Protocol Liveness	177
Troubleshooting BFD	177
Border Gateway Protocol IPv4 (BGPv4)	179
Protocol Overview	180
Autonomous Systems (AS)	180
Sessions and Peers	182
Establishing a session	182
Peer Groups	183
Route Reflectors	183
Confederations	184
Communities	184
BGP Attributes	185
Best Path Selection Criteria	185
Best Path selection details	186
Weight	188
Local Preference	188
Multi-Exit Discriminators (MEDs)	188
Origin	189
AS Path	190
Next Hop	190
Multiprotocol BGP	191
Implementing BGP with FTOS	191
Additional Path (Add-Path) support	191
Advertise IGP cost as MED for redistributed routes	191
Ignore Router-ID for some best-path calculations	192
4-Byte AS Numbers	192
AS4 Number Representation	193
Dynamic AS Number Notation application	194
AS Number Migration	195
BGP4 Management Information Base (MIB)	197
Important Points to Remember	197
Configuration Information	198
BGP Configuration	199
Defaults	199
Configuration Task List for BGP	199
Enable BGP	200
Configure AS4 Number Representations	204
Configure Peer Groups	206
BGP fast fall-over	209
Configure passive peering	211
Maintain existing AS numbers during an AS migration	211
Allow an AS number to appear in its own AS path	213
Enable graceful restart	214
Filter on an AS-Path attribute	215
Redistribute routes	218
Enable additional paths	219
Configure IP community lists	219
Manipulate the COMMUNITY attribute	222
Change MED attribute	224
Change LOCAL_PREFERENCE attribute	224
Change NEXT_HOP attribute	225
Change WEIGHT attribute	226
Enable multipath	226
Filter BGP routes	227
Configure BGP route reflectors	230
Aggregate routes	230
Configure BGP confederations	231
Enable route flap dampening	232
Change BGP timers	235
BGP neighbor soft-reconfiguration	236
Route map continue	237
MBGP Configuration	238
BGP Regular Expression Optimization	239
Debugging BGP	239
Storing Last and Bad PDUs	240
Capturing PDUs	241
PDU Counters	243
Sample Configurations	243
Example: Enable BGP, Router 1	244
Example: Enable BGP, Router 2	245
Example: Enable BGP, Router 3	246
Example: Enable Peer Group, Router 1	247
Example: Enable Peer Groups, Router 1 (Continued)	248
Example: Enable Peer Groups, Router 2	249
Example: Enable Peer Groups, Router 3	250
Example: Enable Peer Groups, Router 3 (Continued)	251
Bare Metal Provisioning 2.0	253
Prerequisites	253
Restrictions	254
Overview	254
Jumpstart mode	255
DHCP Server	255
DHCP Configuration	255
MAC-Based IP assignment	256
DHCP Retry Mechanism	257
File Server	258
Domain Name Server	258
Switch boot and set-up behavior in Jumpstart Mode	258
Content Addressable Memory (CAM)	261
Content Addressable Memory	261
CAM Profiles	262
Microcode	263
CAM Profiling for ACLs	264
Boot Behavior	265
Example: EF Line Card with EG Chassis Profile (Card Problem)	266
Example: EH Line Card with EG Chassis Profile (Card Problem)	266
When to Use CAM Profiling	267
Important Points to Remember	267
Differences Between EtherScale and TeraScale	267
Select CAM Profiles	268
CAM Allocation	268
Test CAM Usage	269
View CAM Profiles	270
View CAM-ACL settings	271
View CAM Usage	272
Configure IPv4Flow Sub-partitions	273
Configure Ingress Layer 2 ACL Sub-partitions	276
Return to the Default CAM Configuration	278
CAM Optimization	278
Applications for CAM Profiling	278
LAG Hashing	278
LAG Hashing based on Bidirectional Flow	279
CAM profile for the VLAN ACL group feature	279
Troubleshoot CAM Profiling	279
CAM Profile Mismatches	279
QoS CAM Region Limitation	280
Control Plane Policing (CoPP)	281
Overview	281
Configure Control Plane Policing	282
Configure CoPP for protocols	283
Sample Config for CoPP protocol configuration	284
Configure CoPP for CPU queues	285
Sample Config for CoPP CPU queue configuration	285
Show commands	286
Data Center Bridging (DCB)	289
Ethernet Enhancements in Data Center Bridging	289
Priority-Based Flow Control	290
Enhanced Transmission Selection	292
Data Center Bridging Exchange Protocol (DCBx)	293
Data Center Bridging in a Traffic Flow	293
Enabling Data Center Bridging	294
QoS dot1p Traffic Classification and Queue Assignment	295
Configuring Priority-Based Flow Control	296
Configuring Lossless Queues	299
Configuring the PFC Buffer in a Switch Stack	300
DCB and Switch Stacking Caveats for the S4820T	301
Configuring Enhanced Transmission Selection	301
ETS Prerequisites and Restrictions	301
Creating a QoS ETS Output Policy	302
Creating an ETS Priority Group	305
Applying an ETS Output Policy for a Priority Group to an Interface	306
ETS Operation with DCBx	307
Configuring Bandwidth Allocation for DCBx CIN	308
Applying DCB Policies in a Switch Stack	309
Configuring DCBx Operation	310
DCBx Operation	310
DCBx Port Roles	310
DCB Configuration Exchange	312
Configuration Source Election	312
Propagation of DCB Information	313
Auto-Detection and Manual Configuration of the DCBx Version	313
DCBx Example	314
DCBx Prerequisites and Restrictions	316
DCBx Configuration Procedure	316
Configuring DCBx on an Interface	316
Configuring DCBx Globally on the Switch	318
DCBx Error Messages	320
An error in DCBx operation is displayed using the syslog messages:	320
Debugging DCBx on an Interface	320
Verifying DCB Configuration	321
PFC and ETS Configuration Examples	334
Using PFC and ETS to Manage Data Center Traffic	334
Using PFC and ETS to Manage Converged Ethernet Traffic in a Switch Stack	338
Hierarchical Scheduling in ETS Output Policies	339
Dynamic Host Configuration Protocol (DHCP)	341
Protocol Overview	341
DHCP Packet Format and Options	342
Assigning an IP Address using DHCP	343
Implementation Information	344
Configuration Tasks	344
Configure the System to be a DHCP Server	344
Configuration Tasks	345
Related Configuration Tasks	345
Configure the Server for Automatic Address Allocation	345
Create an IP Address Pool	346
Exclude Addresses from the Address Pool	346
Specify an Address Lease Time	347
Specify a Default Gateway	347
Enable DHCP Server	347
Configure a Method of Hostname Resolution	348
Address Resolution using DNS	348
Address Resolution using NetBIOS WINS	348
Create Manual Binding Entries	348
Debug DHCP server	349
DHCP Clear Commands	349
Configure the System to be a Relay Agent	349
Configure the System for User Port Stacking	351
Configure Secure DHCP	351
Option 82	351
DHCP Snooping	352
Enable DCHP snooping	353
Add a static entry in the binding table	353
Clear the binding table	353
Display the contents of the binding table	353
Drop DHCP packets on snooped VLANs only	354
Dynamic ARP Inspection	355
Bypass the ARP Inspection	357
Source Address Validation	357
IP Source Address Validation	357
DHCP MAC Source Address Validation	358
IP+MAC Source Address Validation	358
Equal Cost Multi-Path (ECMP)	361
ECMP for Flow-based Affinity	361
Configurable Hash Algorithm	361
Deterministic ECMP Next Hop	362
Configurable Hash Algorithm Seed	362
Link Bundle Monitoring	363
Managing ECMP Group Paths	364
Enabling FIPS Cryptography	365
Preparing the System	365
Enabling FIPS Mode	365
Generating Host-Keys	366
Monitoring FIPS Mode Status	367
Disabling the FIPS Mode	367
FIP Snooping	369
Fibre Channel over Ethernet	369
Ensuring Robustness in a Converged Ethernet Network	369
FIP Snooping on Ethernet Bridges	371
FIP Snooping in a Switch Stack	373
Configuring FIP Snooping	373
Enabling the FIP Snooping Feature	374
Enabling FIP Snooping on VLANs	374
Configuring the FC-MAP Value	374
Configuring a Port for a Bridge-to-Bridge Link	375
Configuring a Port for a Bridge-to-FCF Link	375
Impact on Other Software Features	375
FIP Snooping Prerequisites	375
FIP Snooping Restrictions	376
Configuration Procedure	376
Displaying FIP Snooping Information	377
FIP Snooping Configuration Example	382
Force10 Resilient Ring Protocol (FRRP)	385
Protocol Overview	385
Ring Status	386
Ring Checking	386
Ring Failure	386
Ring Restoration	386
Multiple FRRP Rings	387
Member VLAN Spanning Two Rings Connected by One Switch	387
Important FRRP Points	387
Important FRRP Concepts	388
Implementing FRRP	389
FRRP Configuration	390
Create the FRRP group	390
Configure the Control VLAN	390
Configure and add the Member VLANs	392
Set FRRP Timers	394
Clear FRRP counters	394
Show FRRP configuration	394
Show FRRP information	394
Troubleshooting FRRP	395
Configuration Checks	395
Sample Configuration and Topology	395
GARP VLAN Registration Protocol (GVRP)	397
Protocol Overview	397
Important Points to Remember	397
Configuring GVRP	398
Related Configuration Tasks	399
Enabling GVRP Globally	399
Enabling GVRP on a Layer 2 Interface	399
Configuring GVRP Registration	400
Configuring a GARP Timer	400
High Availability	403
Component Redundancy	404
RPM Redundancy	404
Boot the chassis with a single RPM	404
Boot the chassis with dual RPMs	404
Automatic and manual RPM failover	406
Communication between RPMs	406
Support for RPM redundancy by FTOS version	408
RPM synchronization	409
RPM redundancy configuration tasks	409
Online Insertion and Removal	410
RPM Online Insertion and Removal	410
Linecard Online Insertion and Removal	411
Pre-configure a line card slot	412
Replace a line card	412
Hitless Behavior	413
Graceful Restart	414
Software Resiliency	414
Runtime System Health Check	414
SFM Channel Monitoring	415
Software Component Health Monitoring	415
System Health Monitoring	415
Failure and Event Logging	415
Trace Log	416
Core Dumps	416
System Log	416

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1,000
1,001
1,002
1,003
1,004
1,005
1,006
1,007
1,008
1,009
1,010
1,011
1,012
1,013
1,014
1,015
1,016
1,017
1,018
1,019
1,020
1,021
1,022
1,023
1,024
1,025
1,026
1,027
1,028
1,029
1,030
1,031
1,032
1,033
1,034
1,035
1,036
1,037
1,038
1,039
1,040
1,041
1,042
1,043
1,044
1,045
1,046
1,047
1,048
1,049
1,050
1,051
1,052
1,053
1,054
1,055
1,056
1,057
1,058
1,059
1,060
1,061
1,062
1,063
1,064
1,065
1,066
1,067
1,068
1,069
1,070
1,071
1,072
1,073
1,074
1,075
1,076
1,077
1,078
1,079
1,080
1,081
1,082
1,083
1,084
1,085
1,086
1,087
1,088
1,089
1,090
1,091
1,092
1,093
1,094
1,095
1,096
1,097
1,098
1,099
1,100
1,101
1,102
1,103
1,104
1,105
1,106
1,107
1,108
1,109
1,110
1,111
1,112
1,113
1,114

Match case Limit results 1 per page

Access Control Lists (ACLs)

115

•

Loopback interfaces do not support ACLs using the IP fragment option. If you configure an ACL with

the fragments option and apply it to a loopback interface, the command is accepted, but the ACL

entries are not actually installed the offending rule in CAM.

IP fragments ACL examples

The following configuration permits all packets (both fragmented & non-fragmented) with destination IP

10.1.1.1. The second rule does not get hit at all.

FTOS(conf)#ip access-list extended ABC

FTOS(conf-ext-nacl)#permit ip any 10.1.1.1/32

FTOS(conf-ext-nacl)#

deny ip any 10.1.1.1./32 fragments

FTOS(conf-ext-nacl)

To deny second/subsequent fragments, use the same rules in a different order. These ACLs deny all second

& subsequent fragments with destination IP 10.1.1.1 but permit the first fragment & non fragmented

packets with destination IP 10.1.1.1.

FTOS(conf)#ip access-list extended ABC

FTOS(conf-ext-nacl)#

deny ip any 10.1.1.1/32 fragments

FTOS(conf-ext-nacl)#permit ip any 10.1.1.1/32

FTOS(conf-ext-nacl)

Layer 4 ACL rules examples

In the below scenario, first fragments non-fragmented TCP packets from 10.1.1.1 with TCP destination

port equal to 24 are permitted. All other fragments are denied.

FTOS(conf)#ip access-list extended ABC

FTOS(conf-ext-nacl)#

permit tcp host 10.1.1.1 any eq 24

FTOS(conf-ext-nacl)#deny ip any any fragment

FTOS(conf-ext-nacl)

In the following, TCP packets that are first fragments or non-fragmented from host 10.1.1.1 with TCP

destination port equal to 24 are permitted. Additionally, all TCP non-first fragments from host 10.1.1.1 are

permitted. All other IP packets that are non-first fragments are denied.

FTOS(conf)#ip access-list extended ABC

FTOS(conf-ext-nacl)#permit tcp host 10.1.1.1 any eq 24

FTOS(conf-ext-nacl)#permit tcp host 10.1.1.1 any fragment

FTOS(conf-ext-nacl)#

deny ip any any fragment

FTOS(conf-ext-nacl)

To log all the packets denied and to override the implicit deny rule and the implicit permit rule for

TCP/

UDP fragments, use a configuration similar to the following.

FTOS(conf)#ip access-list extended ABC

FTOS(conf-ext-nacl)#permit tcp any any fragment

FTOS(conf-ext-nacl)#permit udp any any fragment

FTOS(conf-ext-nacl)#deny ip any any log