Dell MX9116n EMC SmartFabric OS10 User Guide - Page 1025

ethernet1/1/29 seq 10 deny ip any any fragment count (100 packets) VTY ACLs To limit Telnet and SSH connections to the switch, apply access lists on a virtual terminal line (VTY). See Virtual terminal line ACLs for more information. SNMP ACLs To filer SNMP requests on the switch, assign access lists to an SNMP community. Both IPv4 and IPv6 access lists are supported to restrict IP source addresses. See Restrict SNMP access for more information. Clear access-list counters Clear IPv4, IPv6, or MAC access-list counters for a specific access-list or all lists. The counter counts the number of packets that match each permit or deny statement in an access-list. To get a more recent count of packets matching an access-list, clear the counters to start at zero. If you do not configure an access-list name, all IP access-list counters clear. To view access-list information, use the show access-lists command. • Clear IPv4 access-list counters in EXEC mode. clear ip access-list counters access-list-name • Clear IPv6 access-list counters in EXEC mode. clear ipv6 access-list counters access-list-name • Clear MAC access-list counters in EXEC mode. clear mac access-list counters access-list-name IP prefix-lists IP prefix-lists control the routing policy. An IP prefix-list is a series of sequential filters that contain a matching criterion and an permit or deny action to process routes. The filters process in sequence so that if a route prefix does not match the criterion in the first filter, the second filter applies, and so on. A route prefix is an IP address pattern that matches on bits within the IP address. The format of a route prefix is A.B.C.D/x, where A.B.C.D is a dotted-decimal address and /x is the number of bits that match the dotted decimal address. When the route prefix matches a filter, the system drops or forwards the packet based on the filter's designated action. If the route prefix does not match any of the filters in the prefix-list, the route drops, an implicit deny. For example, in 112.24.0.0/16, the first 16 bits of the address 112.24.0.0 match all addresses between 112.24.0.0 to 112.24.255.255. Use permit or deny filters for specific routes with the le (less or equal) and ge (greater or equal) parameters, where x.x.x.x/x represents a route prefix: • To deny only /8 prefixes, enter deny x.x.x.x/x ge 8 le 8 • To permit routes with the mask greater than /8 but less than /12, enter permit x.x.x.x/x ge 8 le 12 • To deny routes with a mask less than /24, enter deny x.x.x.x/x le 24 • To permit routes with a mask greater than /20, enter permit x.x.x.x/x ge 20 The following rules apply to prefix-lists: • A prefix-list without permit or deny filters allows all routes • An implicit deny is assumed - the route drops for all route prefixes that do not match a permit or deny filter • After a route matches a filter, the filter's action applies and no additional filters apply to the route Use prefix-lists in processing routes for routing protocols such as open shortest path first (OSPF), route table manager (RTM), and border gateway protocol (BGP). Access Control Lists 1025