Home » Dell Manuals » Hubs & Switches » Dell PowerSwitch S4820T » Manual Viewer

Dell PowerSwitch S4820T Configuration Guide for the S4820T System 9.100.0 - Page 111

Applying an IP ACL, Counting ACL Hits

View all Dell PowerSwitch S4820T manuals

Add to My Manuals
Save this manual to your list of manuals

Page 111 highlights

• Configure Egress ACLs For more information about Layer-3 interfaces, refer to Interfaces. Applying an IP ACL To apply an IP ACL (standard or extended) to a physical or port channel interface, use the following commands. 1 Enter the interface number. CONFIGURATION mode interface interface slot/port 2 Configure an IP address for the interface, placing it in Layer-3 mode. INTERFACE mode ip address ip-address 3 Apply an IP ACL to traffic entering or exiting an interface. INTERFACE mode ip access-group access-list-name {in} [implicit-permit] [vlan vlan-range | vrf vrf-range] NOTE: The number of entries allowed per ACL is hardware-dependent. For detailed specification about entries allowed per ACL, refer to your line card documentation. 4 Apply rules to the new ACL. INTERFACE mode ip access-list [standard | extended] name To view which IP ACL is applied to an interface, use the show config command in INTERFACE mode, or use the show runningconfig command in EXEC mode. Example of Viewing ACLs Applied to an Interface Dell(conf-if)#show conf ! interface TenGigabitEthernet 1/1 ip address 10.2.1.100 255.255.255.0 ip access-group nimule in no shutdown Dell(conf-if)# To filter traffic on Telnet sessions, use only standard ACLs in the access-class command. Counting ACL Hits You can view the number of packets matching the ACL by using the count option when creating ACL entries. 1 Create an ACL that uses rules with the count option. Refer to Configure a Standard IP ACL Filter. 2 Apply the ACL as an inbound or outbound ACL on an interface. 3 show ip accounting access-list EXEC Privilege mode View the number of packets matching the ACL. Access Control Lists (ACLs) 111

Section	Page
Dell Configuration Guide for the S4820T System 9.10(0.0)	3
About this Guide	32
Audience	32
Conventions	32
Related Documents	32
Configuration Fundamentals	33
Accessing the Command Line	33
CLI Modes	33
Navigating CLI Modes	35
The do Command	37
Undoing Commands	38
Obtaining Help	38
Entering and Editing Commands	39
Command History	40
Filtering show Command Outputs	40
Example of the grep Keyword	40
Multiple Users in Configuration Mode	41
Getting Started	42
Console Access	43
Serial Console	43
Accessing the CLI Interface and Running Scripts Using SSH	44
Entering CLI commands Using an SSH Connection	44
Executing Local CLI Scripts Using an SSH Connection	44
Default Configuration	45
Configuring a Host Name	45
Accessing the System Remotely	45
Accessing the System Remotely	45
Configure the Management Port IP Address	45
Configure a Management Route	46
Configuring a Username and Password	46
Configuring the Enable Password	46
Configuration File Management	47
Copy Files to and from the System	47
Mounting an NFS File System	48
Save the Running-Configuration	49
Configure the Overload Bit for a Startup Scenario	50
Viewing Files	50
Managing the File System	51
Enabling Software Features on Devices Using a Command Option	51
View Command History	52
Upgrading Dell Networking OS	52
Using HTTP for File Transfers	52
Verify Software Images Before Installation	53
Management	55
Configuring Privilege Levels	55
Creating a Custom Privilege Level	55
Removing a Command from EXEC Mode	56
Moving a Command from EXEC Privilege Mode to EXEC Mode	56
Allowing Access to CONFIGURATION Mode Commands	56
Allowing Access to Different Modes	56
Applying a Privilege Level to a Username	58
Applying a Privilege Level to a Terminal Line	58
Configuring Logging	58
Audit and Security Logs	59
Configuring Logging Format	60
Display the Logging Buffer and the Logging Configuration	61
Setting Up a Secure Connection to a Syslog Server	61
Log Messages in the Internal Buffer	63
Configuration Task List for System Log Management	63
Disabling System Logging	63
Sending System Messages to a Syslog Server	63
Configuring a UNIX System as a Syslog Server	63
Track Login Activity	64
Restrictions for Tracking Login Activity	64
Configuring Login Activity Tracking	64
Display Login Statistics	65
Limit Concurrent Login Sessions	66
Restrictions for Limiting the Number of Concurrent Sessions	66
Configuring Concurrent Session Limit	66
Enabling the System to Clear Existing Sessions	67
Changing System Logging Settings	67
Display the Logging Buffer and the Logging Configuration	68
Configuring a UNIX Logging Facility Level	69
Synchronizing Log Messages	70
Enabling Timestamp on Syslog Messages	70
File Transfer Services	71
Configuration Task List for File Transfer Services	71
Enabling the FTP Server	71
Configuring FTP Server Parameters	72
Configuring FTP Client Parameters	72
Terminal Lines	73
Denying and Permitting Access to a Terminal Line	73
Configuring Login Authentication for Terminal Lines	74
Setting Timeout for EXEC Privilege Mode	75
Using Telnet to get to Another Network Device	75
Lock CONFIGURATION Mode	76
Viewing the Configuration Lock Status	76
Recovering from a Forgotten Password	76
Recovering from a Forgotten Enable Password	77
Recovering from a Failed Start	78
Restoring the Factory Default Settings	78
Important Points to Remember	79
Restoring Factory Default Environment Variables	79
802.1X	81
Port-Authentication Process	83
EAP over RADIUS	84
Configuring 802.1X	84
Related Configuration Tasks	84
Important Points to Remember	84
Enabling 802.1X	85
Configuring MAC addresses for a do1x Profile	86
Configuring Request Identity Re-Transmissions	87
Configuring a Quiet Period after a Failed Authentication	87
Forcibly Authorizing or Unauthorizing a Port	88
Re-Authenticating a Port	89
Configuring Timeouts	90
Configuring Dynamic VLAN Assignment with Port Authentication	91
Guest and Authentication-Fail VLANs	92
Configuring a Guest VLAN	92
Configuring an Authentication-Fail VLAN	92
Configuring dot1x Profile	93
Configuring the Static MAB and MAB Profile	94
Configuring Critical VLAN	94
Access Control List (ACL) VLAN Groups and Content Addressable Memory (CAM)	96
Optimizing CAM Utilization During the Attachment of ACLs to VLANs	96
Guidelines for Configuring ACL VLAN Groups	97
Configuring ACL VLAN Groups and Configuring FP Blocks for VLAN Parameters	97
Viewing CAM Usage	99
Allocating FP Blocks for VLAN Processes	100
Access Control Lists (ACLs)	101
IP Access Control Lists (ACLs)	102
CAM Usage	102
Implementing ACLs on Dell Networking OS	103
IP Fragment Handling	105
IP Fragments ACL Examples	105
Layer 4 ACL Rules Examples	105
Configure a Standard IP ACL	106
Configuring a Standard IP ACL Filter	107
Configure an Extended IP ACL	108
Configuring Filters with a Sequence Number	108
Configuring Filters Without a Sequence Number	109
Configure Layer 2 and Layer 3 ACLs	110
Assign an IP ACL to an Interface	110
Applying an IP ACL	111
Counting ACL Hits	111
Configure Ingress ACLs	112
Configure Egress ACLs	112
Applying Egress Layer 3 ACLs (Control-Plane)	113
IP Prefix Lists	113
Implementation Information	114
Configuration Task List for Prefix Lists	114
ACL Resequencing	117
Resequencing an ACL or Prefix List	118
Route Maps	119
Implementation Information	119
Important Points to Remember	119
Configuration Task List for Route Maps	120
Configuring Match Routes	122
Configuring Set Conditions	123
Configure a Route Map for Route Redistribution	124
Configure a Route Map for Route Tagging	124
Continue Clause	125
Logging of ACL Processes	125
Guidelines for Configuring ACL Logging	126
Configuring ACL Logging	126
Flow-Based Monitoring Support for ACLs	127
Behavior of Flow-Based Monitoring	127
Enabling Flow-Based Monitoring	128
Bidirectional Forwarding Detection (BFD)	130
How BFD Works	130
BFD Packet Format	131
BFD Sessions	132
BFD Three-Way Handshake	133
Session State Changes	135
Important Points to Remember	135
Configure BFD	135
Configure BFD for Physical Ports	136
Configure BFD for Static Routes	139
Configure BFD for OSPF	141
Configure BFD for OSPFv3	143
Configure BFD for IS-IS	145
Configure BFD for BGP	147
Configure BFD for VRRP	154
Configuring Protocol Liveness	156
Troubleshooting BFD	156
Border Gateway Protocol IPv4 (BGPv4)	158
Autonomous Systems (AS)	158
Sessions and Peers	160
Establish a Session	160
Route Reflectors	161
BGP Attributes	162
Best Path Selection Criteria	162
Weight	164
Local Preference	164
Multi-Exit Discriminators (MEDs)	165
Origin	166
AS Path	166
Next Hop	167
Multiprotocol BGP	167
Implement BGP with Dell Networking OS	168
Additional Path (Add-Path) Support	168
Advertise IGP Cost as MED for Redistributed Routes	168
Ignore Router-ID in Best-Path Calculation	169
Four-Byte AS Numbers	169
AS4 Number Representation	169
AS Number Migration	171
BGP4 Management Information Base (MIB)	172
Important Points to Remember	172
Configuration Information	173
BGP Configuration	173
Enabling BGP	174
Configuring AS4 Number Representations	177
Configuring Peer Groups	178
Configuring BGP Fast Fall-Over	181
Configuring Passive Peering	182
Maintaining Existing AS Numbers During an AS Migration	183
Allowing an AS Number to Appear in its Own AS Path	184
Enabling Graceful Restart	185
Enabling Neighbor Graceful Restart	186
Filtering on an AS-Path Attribute	186
Regular Expressions as Filters	187
Redistributing Routes	189
Enabling Additional Paths	189
Configuring IP Community Lists	190
Configuring an IP Extended Community List	191
Filtering Routes with Community Lists	192
Manipulating the COMMUNITY Attribute	192
Changing MED Attributes	194
Changing the LOCAL_PREFERENCE Attribute	194
Changing the NEXT_HOP Attribute	195
Changing the WEIGHT Attribute	195
Enabling Multipath	196
Filtering BGP Routes	196
Filtering BGP Routes Using Route Maps	197
Filtering BGP Routes Using AS-PATH Information	198
Configuring BGP Route Reflectors	198
Aggregating Routes	199
Configuring BGP Confederations	199
Enabling Route Flap Dampening	200
Changing BGP Timers	202
Enabling BGP Neighbor Soft-Reconfiguration	203
Route Map Continue	204
Enabling MBGP Configurations	204
BGP Regular Expression Optimization	205
Debugging BGP	205
Storing Last and Bad PDUs	206
Capturing PDUs	207
PDU Counters	208
Sample Configurations	208
Content Addressable Memory (CAM)	214
CAM Allocation	214
Test CAM Usage	216
View CAM Profiles	216
View CAM-ACL Settings	217
View CAM Usage	218
CAM Optimization	219
Troubleshoot CAM Profiling	219
CAM Profile Mismatches	219
QoS CAM Region Limitation	219
Control Plane Policing (CoPP)	220
Configure Control Plane Policing	221
Configuring CoPP for Protocols	222
Configuring CoPP for CPU Queues	224
CoPP for OSPFv3 Packets	225
Configuring CoPP for OSPFv3	227
Displaying CoPP Configuration	228
Data Center Bridging (DCB)	230
Ethernet Enhancements in Data Center Bridging	230
Priority-Based Flow Control	231
Enhanced Transmission Selection	232
Data Center Bridging Exchange Protocol (DCBx)	233
Data Center Bridging in a Traffic Flow	234
Enabling Data Center Bridging	234
DCB Maps and its Attributes	235
Data Center Bridging: Default Configuration	236
Configuring Priority-Based Flow Control	236
Configuring Lossless Queues	237
Configuring PFC in a DCB Map	238
PFC Configuration Notes	238
PFC Prerequisites and Restrictions	239
Applying a DCB Map on a Port	239
Configuring PFC without a DCB Map	240
Configuring Lossless QueuesExample:	240
Priority-Based Flow Control Using Dynamic Buffer Method	241
Pause and Resume of Traffic	241
Buffer Sizes for Lossless or PFC Packets	242
Behavior of Tagged Packets	242
Configuration Example for DSCP and PFC Priorities	243
Using PFC to Manage Converged Ethernet Traffic	243
Configure Enhanced Transmission Selection	244
ETS Prerequisites and Restrictions	244
Creating an ETS Priority Group	244
ETS Operation with DCBx	245
Configuring Bandwidth Allocation for DCBx CIN	246
Configuring ETS in a DCB Map	246
Hierarchical Scheduling in ETS Output Policies	248
Using ETS to Manage Converged Ethernet Traffic	248
Applying DCB Policies in a Switch Stack	248
Configure a DCBx Operation	248
DCBx Operation	249
DCBx Port Roles	249
DCB Configuration Exchange	250
Configuration Source Election	251
Propagation of DCB Information	251
Auto-Detection and Manual Configuration of the DCBx Version	251
DCBx Example	252
DCBx Prerequisites and Restrictions	252
Configuring DCBx	253
Verifying the DCB Configuration	256
Sample DCB Configuration	264
PFC and ETS Configuration Command Examples	266
QoS dot1p Traffic Classification and Queue Assignment	266
Configuring the Dynamic Buffer Method	267
Dynamic Host Configuration Protocol (DHCP)	269
DHCP Packet Format and Options	269
Assign an IP Address using DHCP	271
Implementation Information	272
Configure the System to be a DHCP Server	272
Configuring the Server for Automatic Address Allocation	273
Specifying a Default Gateway	274
Configure a Method of Hostname Resolution	274
Using DNS for Address Resolution	274
Using NetBIOS WINS for Address Resolution	275
Creating Manual Binding Entries	275
Debugging the DHCP Server	275
Using DHCP Clear Commands	276
Configure the System to be a Relay Agent	276
Configure the System to be a DHCP Client	277
DHCP Client Operation with Other Features	278
DHCP Client on a Management Interface	279
Configure the System for User Port Stacking (Option 230)	279
Configure Secure DHCP	280
Option 82	280
DHCP Snooping	281
Configuring the DHCP secondary-subnet	284
Drop DHCP Packets on Snooped VLANs Only	284
Dynamic ARP Inspection	285
Configuring Dynamic ARP Inspection	286
Source Address Validation	287
Enabling IP Source Address Validation	287
DHCP MAC Source Address Validation	288
Enabling IP+MAC Source Address Validation	288
Viewing the Number of SAV Dropped Packets	289
Clearing the Number of SAV Dropped Packets	289
Equal Cost Multi-Path (ECMP)	290
ECMP for Flow-Based Affinity	290
Configuring the Hash Algorithm	290
Enabling Deterministic ECMP Next Hop	290
Configuring the Hash Algorithm Seed	291
Link Bundle Monitoring	291
Managing ECMP Group Paths	292
Creating an ECMP Group Bundle	292
Modifying the ECMP Group Threshold	292
RTAG7	293
Flow-based Hashing for ECMP	294
FIP Snooping	297
Fibre Channel over Ethernet	297
Ensure Robustness in a Converged Ethernet Network	297
FIP Snooping on Ethernet Bridges	299
FIP Snooping in a Switch Stack	300
Using FIP Snooping	301
FIP Snooping Prerequisites	301
Important Points to Remember	301
Enabling the FCoE Transit Feature	302
Enable FIP Snooping on VLANs	302
Configure the FC-MAP Value	303
Configure a Port for a Bridge-to-Bridge Link	303
Configure a Port for a Bridge-to-FCF Link	303
Impact on Other Software Features	303
FIP Snooping Restrictions	304
Configuring FIP Snooping	304
Displaying FIP Snooping Information	305
FCoE Transit Configuration Example	310
FIPS Cryptography	312
Configuration Tasks	312
Preparing the System	312
Enabling FIPS Mode	313
Generating Host-Keys	313
Monitoring FIPS Mode Status	313
Disabling FIPS Mode	314
Force10 Resilient Ring Protocol (FRRP)	315
Protocol Overview	315
Ring Status	316
Multiple FRRP Rings	316
Important FRRP Points	317
Important FRRP Concepts	318
Implementing FRRP	319
FRRP Configuration	319
Creating the FRRP Group	319
Configuring the Control VLAN	319
Configuring and Adding the Member VLANs	320
Setting the FRRP Timers	321
Clearing the FRRP Counters	322
Viewing the FRRP Configuration	322
Viewing the FRRP Information	322
Troubleshooting FRRP	322
Configuration Checks	322
Sample Configuration and Topology	323
GARP VLAN Registration Protocol (GVRP)	325
Important Points to Remember	325
Configure GVRP	326
Related Configuration Tasks	326
Enabling GVRP Globally	326
Enabling GVRP on a Layer 2 Interface	327
Configure GVRP Registration	327
Configure a GARP Timer	328
RPM Redundancy	328
High Availability (HA)	329
Component Redundancy	329
RPM Redundancy	329
Automatic and Manual Stack Unit Failover	331
Support for RPM Redundancy by Dell Networking OS Version	332
Synchronization between Management and Standby Units	332
Configuring RPM Redundancy	332
Online Insertion and Removal	333
RPM Online Insertion and Removal	334
Linecard Online Insertion and Removal	334
Hitless Behavior	335
Graceful Restart	336
Software Resiliency	336
Software Component Health Monitoring	336
System Health Monitoring	336
Failure and Event Logging	336
Hot-Lock Behavior	337
Process Restartability	337
Enabling Process Restartability	338
Internet Group Management Protocol (IGMP)	339
IGMP Implementation Information	339
IGMP Protocol Overview	339
IGMP Version 2	339
IGMP Version 3	341
Configure IGMP	343
Related Configuration Tasks	344
Viewing IGMP Enabled Interfaces	344
Selecting an IGMP Version	344
Viewing IGMP Groups	345
Adjusting Timers	345
Adjusting Query and Response Timers	345
Enabling IGMP Immediate-Leave	346
IGMP Snooping	346
IGMP Snooping Implementation Information	346
Configuring IGMP Snooping	346
Removing a Group-Port Association	347
Disabling Multicast Flooding	347
Specifying a Port as Connected to a Multicast Router	348
Configuring the Switch as Querier	348
Fast Convergence after MSTP Topology Changes	349
Egress Interface Selection (EIS) for HTTP and IGMP Applications	349
Protocol Separation	349
Enabling and Disabling Management Egress Interface Selection	350
Handling of Management Route Configuration	351
Handling of Switch-Initiated Traffic	352
Handling of Switch-Destined Traffic	352
Handling of Transit Traffic (Traffic Separation)	353
Mapping of Management Applications and Traffic Type	353
Behavior of Various Applications for Switch-Initiated Traffic	354
Behavior of Various Applications for Switch-Destined Traffic	355
Interworking of EIS With Various Applications	356
Designating a Multicast Router Interface	356
Interfaces	357
Basic Interface Configuration	357
Advanced Interface Configuration	357
Interface Types	358
View Basic Interface Information	358
Resetting an Interface to its Factory Default State	360
Enabling a Physical Interface	360
Physical Interfaces	361
Configuration Task List for Physical Interfaces	361
Overview of Layer Modes	361
Configuring Layer 2 (Data Link) Mode	362
Configuring Layer 2 (Interface) Mode	362
Configuring Layer 3 (Network) Mode	362
Configuring Layer 3 (Interface) Mode	363
Egress Interface Selection (EIS)	364
Important Points to Remember	364
Configuring EIS	364
Management Interfaces	364
Configuring Management Interfaces	364
Configuring a Management Interface on an Ethernet Port	366
VLAN Interfaces	367
Loopback Interfaces	367
Null Interfaces	368
Port Channel Interfaces	368
Port Channel Definition and Standards	368
Port Channel Benefits	368
Port Channel Implementation	369
Interfaces in Port Channels	369
Configuration Tasks for Port Channel Interfaces	369
Creating a Port Channel	370
Adding a Physical Interface to a Port Channel	370
Reassigning an Interface to a New Port Channel	372
Configuring the Minimum Oper Up Links in a Port Channel	372
Adding or Removing a Port Channel from a VLAN	373
Assigning an IP Address to a Port Channel	374
Deleting or Disabling a Port Channel	374
Load Balancing Through Port Channels	374
Changing the Hash Algorithm	375
Bulk Configuration	376
Interface Range	376
Bulk Configuration Examples	376
Defining Interface Range Macros	377
Define the Interface Range	378
Choosing an Interface-Range Macro	378
Monitoring and Maintaining Interfaces	378
Maintenance Using TDR	379
Splitting QSFP Ports to SFP+ Ports	380
Converting a QSFP or QSFP+ Port to an SFP or SFP+ Port	380
Important Points to Remember	381
Example Scenarios	381
Configuring wavelength for 10–Gigabit SFP+ optics	384