Dell PowerSwitch S4112F-ON EMC SmartFabric OS10 User Guide Release 10.5.1 - Page 1246

You can use an egress ACL filter to restrict egress traffic. For example, when you isolate denial of service (DoS) attack traffic to a specific interface, and apply an egress ACL filter to block the DoS flow from exiting the network, you protect downstream devices. 1. Apply an egress access-list on the interface in INTERFACE mode. ip access-group access-group-name out 2. Return to CONFIGURATION mode. exit 3. Create the access-list in CONFIGURATION mode. ip access-list access-list-name 4. Create the rules for the access-list in ACCESS-LIST mode. seq 10 deny ip any any count fragment Apply rules to ACL filter OS10(config)# interface ethernet 1/1/29 OS10(conf-if-eth1/1/29)# ip access-group egress out OS10(conf-if-eth1/1/29)# exit OS10(config)# ip access-list egress OS10(conf-ipv4-acl)# seq 10 deny ip any any count fragment View IP ACL filter configuration OS10# show ip access-lists out Egress IP access-list abcd Active on interfaces : ethernet1/1/29 seq 10 deny ip any any fragment count (100 packets) Configuration notes Dell EMC PowerSwitch S4200-ON Series: ● You can create either Layer 2 ACL or Layer 3 ACL. You cannot create both the tables at a time. ● In egress L3 IPv4 ACL, the fragment, TCP flags, and DSCP fields are not supported. ● In egress ACLs, L2 user table is utilized only for switched packets and L3 user table is utilized only for routed packets. VTY ACLs To limit Telnet and SSH connections to the switch, apply access lists on a virtual terminal line (VTY). See Virtual terminal line ACLs for more information. For VTY ACLs, there is no implicit deny rule. If none of the configured conditions match, the default behavior is to permit. If you need to deny traffic that does not match any of the configured conditions, explicitly configure a deny statement. SNMP ACLs To filer SNMP requests on the switch, assign access lists to an SNMP community. Both IPv4 and IPv6 access lists are supported to restrict IP source addresses. See Restrict SNMP access for more information. NOTE: SNMP ACL works only when the SNMP server is reachable through the default VRF. 1246 Access Control Lists