Home » Dell Manuals » Hubs & Switches » Dell PowerSwitch S4128F-ON » Manual Viewer

Dell PowerSwitch S4128F-ON EMC SmartFabric OS10 User Guide Release 10.5.0 - Page 1074

Control-plane ACLs, Control-plane ACL qualifiers

View all Dell PowerSwitch S4128F-ON manuals

Add to My Manuals
Save this manual to your list of manuals

Page 1074 highlights

Destination MAC packet address Packet protocol VLAN ID Class of service MAC address range-address-mask in 3x4 dotted hexadecimal notation, and any to denote that the rule matches all destination addresses. Set by its EtherType field contents and assigned protocol number for all protocols. Set in the packet header Present in the packet header IPv4/IPv6 and MAC ACLs apply separately for inbound and outbound packets. You can assign an interface to multiple ACLs, with a limit of one ACL per packet direction per ACL type. Control-plane ACLs OS10 offers control-plane ACLs to selectively restrict packets that are destined to the CPU port, thereby providing increased security. Control-plane ACLs offer: • An option to protect the CPU from denial of service (DoS) attacks. • Fine-grained control to allow or block traffic going to the CPU. Control-plane ACLs apply on the front-panel and management ports. Control-plane ACLs are one of the following types: • IP ACL • IPv6 ACL • MAC ACL NOTE: MAC ACL is applied only on packets that enter through the front-panel ports. There is no implicit deny rule. If none of the configured conditions match, the default behavior is to permit. If you need to deny traffic that does not match any of the configured conditions, explicitly configure a deny statement. The control-plane ACL is mutually exclusive with VTY ACL, the management ACL. VTY ACL provides secure access for session connection protocols, such as SSH or TELNET; however, control-plane ACLs permit or deny any TCP or UDP, including SSH and TELNET sessions, from specific hosts and networks, and also filters both IPv4 and IPv6 traffic. Configure control-plane ACL To configure control-plane ACLs, use the existing ACL template and create the appropriate rules to permit or deny traffic as needed, similar to creating an access list for VTY ACLs. However, when you apply this control-plane ACL, you must apply it in CONTROL-PLANE mode instead of VTY mode. For example: OS10# configure terminal OS10(config)# control-plane OS10(config-control-plane)# ip access-group acl_name in where acl_name is the name of the control-plane ACL, a maximum of 140 characters. NOTE: Apply control-plane ACLs on ingress traffic only. Control-plane ACL qualifiers This section lists the supported control-plane ACL rule qualifiers. NOTE: OS10 supports only the qualifiers listed below. Ensure that you use only these qualifiers in ACL rules. • IPv4 qualifiers: ○ DST_IP-Destination IP address ○ SRC_IP-Source IP address ○ IP_TYPE-IP type ○ IP_PROTOCOL-Protocols such as TCP, UDP, and so on ○ L4_DST_PORT-Destination port number • IPv6 qualifiers: ○ DST_IPv6-Destination address ○ SRC_IPv6-Source address ○ IP_TYPE-IP Type; for example, IPv4 or IPv6 1074 Access Control Lists

Section	Page
Dell EMC SmartFabric OS10 User Guide Release 10.5.0	3
Change history	28
Getting Started with Dell EMC SmartFabric OS10	31
Switch with factory-installed OS10	32
Log in	32
Check OS10 version	33
OS10 upgrade	33
Download OS10 image for upgrade	33
Install OS10 upgrade	33
Install OS10 upgrade	35
Install firmware upgrade	37
Upgrade commands	37
boot system	37
image cancel	37
image copy	38
image download	38
image install	38
show boot	39
show image firmware	40
show image status	40
show version	41
Check OS10 license	41
Re-install license	42
Switch without OS installed	42
Uninstall existing OS	43
Download OS10 image	43
Installation using ONIE	44
Automatic installation	44
Manual installation	46
Log in	46
Install OS10 license	47
Switch deployment options	49
Manual CLI configuration	49
ZTD-automated switch deployment	50
Ansible-automated switch provisioning	50
MX7000 Feb 2020 Solution Update Instructions	50
Remote access	57
Configure Management IP address	57
Configure Management route	58
Configure username and password	58
CLI Basics	60
CONFIGURATION mode	61
Check device status	61
Related Videos	63
Command help	63
Candidate configuration	64
Copy running configuration	66
Restore startup configuration	66
Reload system image	67
Filter show commands	67
Common OS10 commands	68
boot	68
commit	68
configure	68
copy	69
delete	70
dir	71
discard	72
do	72
end	72
exit	73
hostname	73
license	74
lock	74
management route	74
move	75
no	75
ping	76
ping6	77
reload	79
show boot	79
show candidate-configuration	80
show environment	82
show inventory	83
show ip management-route	83
show ipv6 management-route	84
show license status	84
show running-configuration	85
show startup-configuration	87
show system	88
show version	90
start	90
system	91
system-cli disable	91
system-user linuxadmin disable	92
system identifier	92
terminal	92
traceroute	93
unlock	94
username password role	94
write	95
Advanced CLI tasks	96
Command alias	96
Multi-line alias	97
alias	99
alias (multi-line)	100
default (alias)	101
description (alias)	101
line (alias)	101
show alias	102
Batch mode	103
batch	103
Linux shell commands	104
Using OS9 commands	106
feature config-os9-style	106
Dell EMC SmartFabric OS10 zero-touch deployment	107
ZTD DHCP server configuration	109
ZTD provisioning script	109
ZTD CLI batch file	110
Post-ZTD script	110
ZTD commands	111
reload ztd	111
show ztd-status	111
ztd cancel	112
Dell EMC SmartFabric OS10 provisioning	113
Using Ansible	113
Example: Configure an OS10 switch using Ansible	114
SmartFabric Services	117
SmartFabric Services personalities	117
SmartFabric Services for leaf and spine	117
SmartFabric Services for PowerEdge MX	118
SmartFabric Services for leaf and spine	119
SmartFabric Services Components	120
SmartFabric Services logical entities	121
Uplinks	122
Uplink bonding options	123
Spanning tree considerations	123
Dynamic onboarding for integrated devices	123
Statically onboarded server	123
Static onboarding for nonintegrated devices	124
Backup and Restore of fabric state	124
Enable SmartFabric Services on the switches	124
Enable SmartFabric Services using GUI	125
SmartFabric Services Graphical User Interface	125
Configure SmartFabric Services initial setup	126
Update Default Fabric, Switch Names, and Descriptions wizard	127
Create Uplink for External Network Connectivity wizard	127
Configure Layer 2 uplink	127
Configure Layer 3 VLAN uplink	127
Configure Layer 3 Routed uplink	128
Breakout Switch Ports wizard	128
Configure Jump Host wizard	129
Update Network Configuration wizard	129
Onboard a Server onto the Fabric wizard	129
Edit Default Fabric Settings wizard	129
Restore wizard	130
Fabric operations and life cycle management	130
Configuring FEC using MSM	130
SFS Support for MSTP on Layer3 fabric	130
SmartFabric commands	131
smartfabric l3fabric enable	131
smartfabric vlti	132
show smartfabric cluster	132
show smartfabric cluster member	133
show smartfabric details	134
show smartfabric networks	135
show smartfabric nodes	135
show smartfabric personality	136
show smartfabric uplinks	137
show smartfabric validation-errors	138
show smartfabric discovered-server	139
show smartfabric discovered-server discovered-server-interface	140
show smartfabric configured-server	140
show smartfabric configured-server configured-server-interface	141
SmartFabric Director	143
Enable SmartFabric Director mode on a switch	143
Support for SmartFabric Director	143
gRPC Network Management Interface agent	143
Lifecycle Management using SmartFabric Director	146
SmartFabric Director commands	147
switch-operating-mode	147
gnmi-security-profile	147
show switch-operating-mode	148
show sfd status	148
System management	149
System banners	149
Login banner	149
Message of the day banner	150
System banner commands	150
banner login	150
banner motd	151
User session management	151
User session management commands	152
exec-timeout	152
kill-session	152
show sessions	152
Telnet server	153
Telnet commands	153
ip telnet server enable	153
ip telnet server vrf	154
Simple Network Management Protocol	154
SNMP security models and levels	154
MIBs	155
SNMPv3	156
SNMP engine ID	156
SNMP groups and users	156
SNMP views	156
Configure SNMP	156
Configure SNMP engine ID	157
Configure SNMP views	157
Configure SNMP groups	157
Configure SNMP users	158
Generate SNMPv3 localized keys	159
Configure SNMP traps	159
Configure SNMP informs	160
SNMP commands	160
show snmp community	160
show snmp engineID	161
show snmp group	161
show snmp user	161
show snmp view	162
snmp-server community	162
snmp-server contact	163
snmp-server enable traps	163
snmp-server engineID	164
snmp-server group	164
snmp-server host	165
snmp-server location	166
snmp-server user	167
snmp-server view	168
snmp-server vrf	168
Example: Configure SNMP	169
System clock	169
Time zones and UTC offset reference	170
System Clock commands	187
clock set	187
clock timezone	187
show clock	188
show clock timezone	188
Network Time Protocol	189
Enable NTP	189
Broadcasts	190
Source IP address	190
Authentication	191
Sample NTP configuration	192
NTP commands	194
ntp authenticate	194
ntp authentication-key	195
ntp broadcast client	195
ntp disable	195
ntp enable vrf	196
ntp master	196
ntp server	196
ntp source	197
ntp trusted-key	197
show ntp associations	198
show ntp status	198
Dynamic Host Configuration Protocol	199
Packet format and options	200
DHCP server	201
Automatic address allocation	201
Hostname resolution	202
Manual binding entries	203
View DHCP Information	204
DHCP relay agent	205
Option 82 for security	205
DHCP snooping	205
DHCP snooping examples	209
DHCP snooping switch as a relay agent	211
DHCP snooping in a Layer 2 VLT setup	212
DHCP snooping with DHCP relay agent in a VLT setup	215
Dynamic ARP inspection	218
Source Address Validation	220
System domain name and list	221
DHCP commands	222
DHCP relay commands	222
ip helper-address	222
ipv6 helper-address	222
DHCP server commands	223
default-router address	223
disable	223
domain-name	224
dns-server address	224
hardware-address	224
host	224
ip dhcp server	225
lease	225
netbios-name-server address	225
netbios-node-type	226
network	226
pool	226
range	227
show ip dhcp binding	227
DHCP snooping commands	227
arp inspection	227
arp inspection-trust	228
arp inspection violation logging	228
clear ip arp inspection statistics	228
clear ip dhcp snooping binding	229
ip dhcp snooping (global)	229
ip dhcp snooping (interface)	230
ip dhcp snooping binding	230
ip dhcp snooping trust	230
ip dhcp snooping verify mac-address	231
show ip arp inspection database	231
show ip arp inspection statistics	232
show ip arp inspection logging	232
show ip dhcp snooping binding	232
DNS commands	233
ip domain-list	233
ip domain-name	233
ip host	233
ip name-server	234
show hosts	234
Interfaces	236
Ethernet interfaces	236
Unified port groups	236
Z9264F-ON port-group profiles	238
Port-groups on S5200F-ON switches	239
L2 mode configuration	246
L3 mode configuration	247
Fibre Channel interfaces	247
Configuring wavelength	249
Management interface	250
Management interface	250
VLAN interfaces	250
User-configured default VLAN	251
VLAN scale profile	251
Loopback interfaces	252
Port-channel interfaces	252
Create port-channel	253
Add port member	253
Minimum links	254
Assign Port Channel IP Address	254
Remove or disable port-channel	254
Load balance traffic	255
Change hash algorithm	255
Configure interface ranges	255
Switch-port profiles	256
S4148-ON Series port profiles	257
S4148U-ON port profiles	258
Configure negotiation modes on interfaces	259
Configure breakout mode	260
Breakout auto-configuration	261
Reset default configuration	262
Forward error correction	263
Energy-efficient Ethernet	264
Enable energy-efficient Ethernet	264
Clear EEE counters	265
View EEE status/statistics	265
EEE commands	266
clear counters interface eee	266
clear counters interface ethernet eee	266
eee	266
show interface eee	267
show interface eee statistics	267
show interface ethernet eee	267
show interface ethernet eee statistics	268
View interface configuration	268
Digital optical monitoring	271
Enable DOM and DOM traps	272
Default MTU Configuration	273
Interface commands	274
channel-group	274
default interface	274
default vlan-id	276
description (Interface)	277
duplex	278
enable dom	278
enable dom traps	278
feature auto-breakout	279
fec	279
interface breakout	280
interface ethernet	280
interface loopback	280
interface mgmt	281
interface null	281
interface port-channel	281
interface range	282
interface vlan	282
link-bundle-utilization	283
mode	283
mode l3	284
mtu	284
negotiation	285
port mode Eth	286
port-group	287
profile	287
scale-profile vlan	288
show discovered-expanders	288
show interface	289
show interface transceiver “Tunable wavelength”	290
show inventory media	291
show link-bundle-utilization	292
show port-channel summary	292
show port-group	293
show switch-port-profile	294
show system	294
show unit-provision	295
show vlan	296
shutdown	296
speed (Fibre Channel)	296
speed (Management)	297
switch-port-profile	297
switchport access vlan	299
switchport mode	299
switchport trunk allowed vlan	300
unit-provision	300
wavelength	301
default mtu	301
show default mtu	302
PowerEdge MX Ethernet I/O modules	303
Operating modes	303
Changing operating modes	305
Restrictions	305
Port groups on I/O modules	305
Double-density QSFP28 interfaces	305
Virtual ports	307
Single-density QSFP28 interfaces	310
Server-facing interfaces	312
Replace MX Ethernet I/O modules	313
Deployment instructions	313
Replace an IOM in Full-Switch VLT	313
Replace an IOM in SmartFabric	313
Remove and replace the faulty IOM	314
Verify and configure IOM settings	314
Identify the master IOM	314
Log in to the master IOM from the member	315
Initiate the module replacement workflow	316
Connect the new IOM	316
View SmartFabric Services configuration	316
Fibre Channel	317
Fibre Channel over Ethernet	318
Configure FIP snooping	318
Terminology	320
Virtual fabric	320
Fibre Channel zoning	322
F_Port on Ethernet	324
Pinning FCoE traffic to a specific port of a port-channel	324
Sample FSB configuration on VLT network	326
Sample FC Switch configuration on VLT network	328
Sample FSB configuration on non-VLT network	330
Sample FC Switch configuration on non-VLT network	332
Multi-hop FIP-snooping bridge	333
Configuration notes	333
Configure multi-hop FSB	334
Verify multi-hop FSB configuration	340
Sample Multi-hop FSB configuration	341
Configuration guidelines	354
NPIV Proxy Gateway cascading	354
Support for untagged VLAN in FCoE	357
Rebalance FC sessions (NPG)	357
Load balancing after system reboot	357
NPG rebalance topology	357
NPG switch configurations	358
Example: Manual rebalance trigger	360
Equivalent RESTCONF request for the rebalancing CLIs	362
F_Port commands	362
fc alias	362
fc zone	363
fc zoneset	363
feature fc	363
member (alias)	364
member (zone)	364
member (zoneset)	365
show fc alias	365
show fc interface-area-id mapping	365
show fc ns switch	366
show fc zone	366
show fc zoneset	367
zone default-zone permit	368
zoneset activate	368
NPG commands	369
fc port-mode F	369
feature fc npg	369
show npg devices	370
F_Port and NPG commands	370
clear fc statistics	370
fcoe	371
fcoe delay fcf-adv	371
name	371
Re-balance the FC sessions	372
show npg uplink-interface	374
show npg node-interface	375
show fc statistics	376
show fc switch	377
show running-config vfabric	377
show vfabric	378
vfabric	378
vfabric (interface)	379
vlan	379
FIP-snooping commands	379
feature fip-snooping	380
fip-snooping enable	380
fip-snooping fc-map	380
fip-snooping port-mode	381
FCoE commands	381
clear fcoe database	381
clear fcoe statistics	382
fcoe-pinned-port	382
fcoe max-sessions-per-enodemac	382
fcoe priority-bits	383
lldp tlv-select dcbxp-appln fcoe	383
show fcoe enode	384
show fcoe fcf	384
show fcoe pinned-port	385
show fcoe sessions	385
show fcoe statistics	386
show fcoe system	386
show fcoe vlan	387

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1,000
1,001
1,002
1,003
1,004
1,005
1,006
1,007
1,008
1,009
1,010
1,011
1,012
1,013
1,014
1,015
1,016
1,017
1,018
1,019
1,020
1,021
1,022
1,023
1,024
1,025
1,026
1,027
1,028
1,029
1,030
1,031
1,032
1,033
1,034
1,035
1,036
1,037
1,038
1,039
1,040
1,041
1,042
1,043
1,044
1,045
1,046
1,047
1,048
1,049
1,050
1,051
1,052
1,053
1,054
1,055
1,056
1,057
1,058
1,059
1,060
1,061
1,062
1,063
1,064
1,065
1,066
1,067
1,068
1,069
1,070
1,071
1,072
1,073
1,074
1,075
1,076
1,077
1,078
1,079
1,080
1,081
1,082
1,083
1,084
1,085
1,086
1,087
1,088
1,089
1,090
1,091
1,092
1,093
1,094
1,095
1,096
1,097
1,098
1,099
1,100
1,101
1,102
1,103
1,104
1,105
1,106
1,107
1,108
1,109
1,110
1,111
1,112
1,113
1,114
1,115
1,116
1,117
1,118
1,119
1,120
1,121
1,122
1,123
1,124
1,125
1,126
1,127
1,128
1,129
1,130
1,131
1,132
1,133
1,134
1,135
1,136
1,137
1,138
1,139
1,140
1,141
1,142
1,143
1,144
1,145
1,146
1,147
1,148
1,149
1,150
1,151
1,152
1,153
1,154
1,155
1,156
1,157
1,158
1,159
1,160
1,161
1,162
1,163
1,164
1,165
1,166
1,167
1,168
1,169
1,170
1,171
1,172
1,173
1,174
1,175
1,176
1,177
1,178
1,179
1,180
1,181
1,182
1,183
1,184
1,185
1,186
1,187
1,188
1,189
1,190
1,191
1,192
1,193
1,194
1,195
1,196
1,197
1,198
1,199
1,200
1,201
1,202
1,203
1,204
1,205
1,206
1,207
1,208
1,209
1,210
1,211
1,212
1,213
1,214
1,215
1,216
1,217
1,218
1,219
1,220
1,221
1,222
1,223
1,224
1,225
1,226
1,227
1,228
1,229
1,230
1,231
1,232
1,233
1,234
1,235
1,236
1,237
1,238
1,239
1,240
1,241
1,242
1,243
1,244
1,245
1,246
1,247
1,248
1,249
1,250
1,251
1,252
1,253
1,254
1,255
1,256
1,257
1,258
1,259
1,260
1,261
1,262
1,263
1,264
1,265
1,266
1,267
1,268
1,269
1,270
1,271
1,272
1,273
1,274
1,275
1,276
1,277
1,278
1,279
1,280
1,281
1,282
1,283
1,284
1,285
1,286
1,287
1,288
1,289
1,290
1,291
1,292
1,293
1,294
1,295
1,296
1,297
1,298
1,299
1,300
1,301
1,302
1,303
1,304
1,305
1,306
1,307
1,308
1,309
1,310
1,311
1,312
1,313
1,314
1,315
1,316
1,317
1,318
1,319
1,320
1,321
1,322
1,323
1,324
1,325
1,326
1,327
1,328
1,329
1,330
1,331
1,332
1,333
1,334
1,335
1,336
1,337
1,338
1,339
1,340
1,341
1,342
1,343
1,344
1,345
1,346
1,347
1,348
1,349
1,350
1,351
1,352
1,353
1,354
1,355
1,356
1,357
1,358
1,359
1,360
1,361
1,362
1,363
1,364
1,365
1,366
1,367
1,368
1,369
1,370
1,371
1,372
1,373
1,374
1,375
1,376
1,377
1,378
1,379
1,380
1,381
1,382
1,383
1,384
1,385
1,386
1,387
1,388
1,389
1,390
1,391
1,392
1,393
1,394
1,395
1,396
1,397
1,398
1,399
1,400
1,401
1,402
1,403
1,404
1,405

Match case Limit results 1 per page

Destination MAC

packet address

MAC address range—address-mask in 3x4 dotted hexadecimal notation, and

any

to denote that the rule matches

all destination addresses.

Packet protocol

Set by its

EtherType

field contents and assigned protocol number for all protocols.

VLAN ID

Set in the packet header

Class of service

Present in the packet header

IPv4/IPv6 and MAC ACLs apply separately for inbound and outbound packets. You can assign an interface to multiple ACLs, with a limit of

one ACL per packet direction per ACL type.

Control-plane ACLs

OS10 offers control-plane ACLs to selectively restrict packets that are destined to the CPU port, thereby providing increased security.

Control-plane ACLs offer:

•

An option to protect the CPU from denial of service (DoS) attacks.

•

Fine-grained control to allow or block traffic going to the CPU.

Control-plane ACLs apply on the front-panel and management ports. Control-plane ACLs are one of the following types:

•

IP ACL

•

IPv6 ACL

•

MAC ACL

NOTE:

MAC ACL is applied only on packets that enter through the front-panel ports.

There is no implicit deny rule. If none of the configured conditions match, the default behavior is to permit. If you need to deny traffic that

does not match any of the configured conditions, explicitly configure a deny statement.

The control-plane ACL is mutually exclusive with VTY ACL, the management ACL. VTY ACL provides secure access for session

connection protocols, such as SSH or TELNET; however, control-plane ACLs permit or deny any TCP or UDP, including SSH and TELNET

sessions, from specific hosts and networks, and also filters both IPv4 and IPv6 traffic.

Configure control-plane ACL

To configure control-plane ACLs, use the existing ACL template and create the appropriate rules to permit or deny traffic as needed,

similar to creating an access list for VTY ACLs. However, when you apply this control-plane ACL, you must apply it in CONTROL-PLANE

mode instead of VTY mode. For example:

OS10# configure terminal

OS10(config)# control-plane

OS10(config-control-plane)# ip access-group

acl_name

where

acl_name

is the name of the control-plane ACL, a maximum of 140 characters.

NOTE:

Apply control-plane ACLs on ingress traffic only.

Control-plane ACL qualifiers

This section lists the supported control-plane ACL rule qualifiers.

NOTE:

OS10 supports only the qualifiers listed below. Ensure that you use only these qualifiers in ACL rules.

•

IPv4 qualifiers:

○

DST_IP

—Destination IP address

○

SRC_IP

—Source IP address

○

IP_TYPE

—IP type

○

IP_PROTOCOL

—Protocols such as TCP, UDP, and so on

○

L4_DST_PORT

—Destination port number

•

IPv6 qualifiers:

○

DST_IPv6

—Destination address

○

SRC_IPv6

—Source address

○

IP_TYPE

—IP Type; for example, IPv4 or IPv6

1074

Access Control Lists