Home » Dell Manuals » Hubs & Switches » Dell PowerSwitch S4820T » Manual Viewer

Dell PowerSwitch S4820T 9.50.1 Configuration Guide for the S4820T System - Page 128

Assign an IP ACL to an Interface, Applying an IP ACL, L2 ACL Behavior, Decision on Targeted Traffic

View all Dell PowerSwitch S4820T manuals

Add to My Manuals
Save this manual to your list of manuals

Page 128 highlights

L2 ACL Behavior Permit Permit L3 ACL Behavior Deny Permit Decision on Targeted Traffic L3 ACL denies. L3 ACL permits. NOTE: If you configure an interface as a vlan-stack access port, only the L2 ACL filters the packets. The L3 ACL applied to such a port does not affect traffic. That is, existing rules for other features (such as trace-list, policy-based routing [PBR], and QoS) are applied to the permitted traffic. For information about MAC ACLs, refer to Layer 2. Assign an IP ACL to an Interface To pass traffic through a configured IP ACL, assign that ACL to a physical interface, a port channel interface, or a VLAN. The IP ACL is applied to all traffic entering a physical or port channel interface and the traffic is either forwarded or dropped depending on the criteria and actions specified in the ACL. The same ACL may be applied to different interfaces and that changes its functionality. For example, you can take ACL "ABCD" and apply it using the in keyword and it becomes an ingress access list. If you apply the same ACL using the out keyword, it becomes an egress access list. If you apply the same ACL to the Loopback interface, it becomes a Loopback access list. This section describes the following: • Configure Ingress ACLs • Configure Egress ACLs For more information about Layer-3 interfaces, refer to Interfaces. Applying an IP ACL To apply an IP ACL (standard or extended) to a physical or port channel interface, use the following commands. 1. Enter the interface number. CONFIGURATION mode interface interface slot/port 2. Configure an IP address for the interface, placing it in Layer-3 mode. INTERFACE mode ip address ip-address 3. Apply an IP ACL to traffic entering or exiting an interface. INTERFACE mode ip access-group access-list-name {in} [implicit-permit] [vlan vlan-range | vrf vrf-range] NOTE: The number of entries allowed per ACL is hardware-dependent. For detailed specification about entries allowed per ACL, refer to your line card documentation. 128 Access Control Lists (ACLs)

Section	Page
Dell Configuration Guide for the S4820T System 9.5(0.1)	3
About this Guide	35
Audience	35
Conventions	35
Related Documents	35
Configuration Fundamentals	36
Accessing the Command Line	36
CLI Modes	36
Navigating CLI Modes	37
The do Command	40
Undoing Commands	41
Obtaining Help	42
Entering and Editing Commands	42
Command History	43
Filtering show Command Outputs	43
Multiple Users in Configuration Mode	45
Getting Started	46
Console Access	46
Serial Console	46
Accessing the CLI Interface and Running Scripts Using SSH	47
S4820T	47
Entering CLI commands Using an SSH Connection	48
Executing Local CLI Scripts Using an SSH Connection	48
Default Configuration	49
Configuring a Host Name	49
Accessing the System Remotely	49
Accessing the S4820T and Remotely	49
Configure the Management Port IP Address	49
Configure a Management Route	50
Configuring a Username and Password	50
Configuring the Enable Password	50
Configuration File Management	51
Copy Files to and from the System	51
Save the Running-Configuration	52
Configure the Overload Bit for a Startup Scenario	53
Viewing Files	53
Managing the File System	54
Enabling Software Features on Devices Using a Command Option	55
View Command History	56
Upgrading Dell Networking OS	56
Using HTTP for File Transfers	56
Using Hashes to Validate Software Images	56
Management	59
Configuring Privilege Levels	59
Creating a Custom Privilege Level	59
Removing a Command from EXEC Mode	59
Moving a Command from EXEC Privilege Mode to EXEC Mode	59
Allowing Access to CONFIGURATION Mode Commands	60
Allowing Access to the Following Modes	60
Applying a Privilege Level to a Username	62
Applying a Privilege Level to a Terminal Line	62
Configuring Logging	62
Audit and Security Logs	63
Configuring Logging Format	64
Display the Logging Buffer and the Logging Configuration	65
Setting Up a Secure Connection to a Syslog Server	66
Log Messages in the Internal Buffer	67
Configuration Task List for System Log Management	67
Disabling System Logging	67
Sending System Messages to a Syslog Server	67
Configuring a UNIX System as a Syslog Server	68
Changing System Logging Settings	68
Display the Logging Buffer and the Logging Configuration	69
Configuring a UNIX Logging Facility Level	70
Synchronizing Log Messages	71
Enabling Timestamp on Syslog Messages	71
File Transfer Services	72
Configuration Task List for File Transfer Services	72
Enabling the FTP Server	72
Configuring FTP Server Parameters	73
Configuring FTP Client Parameters	73
Terminal Lines	74
Denying and Permitting Access to a Terminal Line	74
Configuring Login Authentication for Terminal Lines	75
Setting Time Out of EXEC Privilege Mode	76
Using Telnet to get to Another Network Device	76
Lock CONFIGURATION Mode	77
Viewing the Configuration Lock Status	77
Recovering from a Forgotten Password on the S4820T System	78
Recovering from a Forgotten Enable Password on the S4820T	79
Recovering from a Failed Start on the S4820T System	80
Restoring the Factory Default Settings	80
S4820TMXL Switch	80
Important Points to Remember	80
Restoring Factory Default Environment Variables	81
802.1ag	83
Ethernet CFM	83
Maintenance Domains	84
Maintenance Points	84
Maintenance End Points	85
Implementation Information	86
Configuring the CFM	86
Related Configuration Tasks	86
Enabling Ethernet CFM	86
Creating a Maintenance Domain	86
Creating a Maintenance Association	87
Create Maintenance Points	87
Creating a Maintenance End Point	87
Creating a Maintenance Intermediate Point	88
Displaying the MP Databases	89
Continuity Check Messages	90
Enabling CCM	91
Enabling Cross-Checking	91
Sending Loopback Messages and Responses	91
Sending Linktrace Messages and Responses	92
Caching Link Trace	92
Enabling CFM SNMP Traps	93
Displaying Ethernet CFM Statistics	95
802.1X	96
The Port-Authentication Process	97
EAP over RADIUS	99
Configuring 802.1X	99
Related Configuration Tasks	99
Important Points to Remember	100
Enabling 802.1X	100
Configuring Request Identity Re-Transmissions	102
Configuring a Quiet Period after a Failed Authentication	102
Forcibly Authorizing or Unauthorizing a Port	103
Re-Authenticating a Port	104
Configuring Timeouts	105
Configuring Dynamic VLAN Assignment with Port Authentication	106
Guest and Authentication-Fail VLANs	107
Configuring a Guest VLAN	108
Configuring an Authentication-Fail VLAN	108
Access Control List (ACL) VLAN Groups and Content Addressable Memory (CAM)	110
Optimizing CAM Utilization During the Attachment of ACLs to VLANs	110
Guidelines for Configuring ACL VLAN groups	111
Configuring ACL VLAN Groups and Configuring FP Blocks for VLAN Parameters	112
Viewing CAM Usage	114
Allocating FP Blocks for VLAN Processes	115
Access Control Lists (ACLs)	117
IP Access Control Lists (ACLs)	118
CAM Usage	118
Implementing ACLs on Dell Networking OS	120
IP Fragment Handling	121
IP Fragments ACL Examples	121
Layer 4 ACL Rules Examples	122
Configure a Standard IP ACL	123
Configuring a Standard IP ACL Filter	124
Configure an Extended IP ACL	125
Configuring Filters with a Sequence Number	125
Configuring Filters Without a Sequence Number	126
Configure Layer 2 and Layer 3 ACLs	127
Assign an IP ACL to an Interface	128
Applying an IP ACL	128
Counting ACL Hits	129
Configure Ingress ACLs	129
Configure Egress ACLs	130
Applying Egress Layer 3 ACLs (Control-Plane)	131
IP Prefix Lists	131
Implementation Information	132
Configuration Task List for Prefix Lists	132
ACL Resequencing	136
Resequencing an ACL or Prefix List	137
Route Maps	138
Implementation Information	138
Important Points to Remember	138
Configuration Task List for Route Maps	139
Configuring Match Routes	141
Configuring Set Conditions	143
Configure a Route Map for Route Redistribution	144
Configure a Route Map for Route Tagging	144
Continue Clause	145
Logging of ACL Processes	145
Guidelines for Configuring ACL Logging	146
Configuring ACL Logging	147
Flow-Based Monitoring Support for ACLs	147
Behavior of Flow-Based Monitoring	148
Enabling Flow-Based Monitoring	149
Bidirectional Forwarding Detection (BFD)	151
How BFD Works	151
BFD Packet Format	152
BFD Sessions	154
BFD Three-Way Handshake	154
Session State Changes	155
Important Points to Remember	156
Configure BFD	156
Configure BFD for Physical Ports	157
Configure BFD for Static Routes	160
Configure BFD for OSPF	162
Configure BFD for OSPFv3	165
Configure BFD for IS-IS	166
Configure BFD for BGP	169
Configure BFD for VRRP	176
Configuring Protocol Liveness	179
Troubleshooting BFD	179
Border Gateway Protocol IPv4 (BGPv4)	181
Autonomous Systems (AS)	181
Sessions and Peers	183
Establish a Session	184
Route Reflectors	184
BGP Attributes	185
Best Path Selection Criteria	186
Weight	188
Local Preference	188
Multi-Exit Discriminators (MEDs)	189
Origin	190
AS Path	191
Next Hop	191
Multiprotocol BGP	192
Implement BGP with Dell Networking OS	192
Additional Path (Add-Path) Support	192
Advertise IGP Cost as MED for Redistributed Routes	192
Ignore Router-ID for Some Best-Path Calculations	193
Four-Byte AS Numbers	193
AS4 Number Representation	194
AS Number Migration	195
BGP4 Management Information Base (MIB)	197
Important Points to Remember	197
Configuration Information	198
BGP Configuration	198
Enabling BGP	199
Configuring AS4 Number Representations	203
Configuring Peer Groups	205
Configuring BGP Fast Fall-Over	207
Configuring Passive Peering	209
Maintaining Existing AS Numbers During an AS Migration	210
Allowing an AS Number to Appear in its Own AS Path	211
Enabling Graceful Restart	212
Enabling Neighbor Graceful Restart	213
Filtering on an AS-Path Attribute	213
Regular Expressions as Filters	215
Redistributing Routes	216
Enabling Additional Paths	217
Configuring IP Community Lists	217
Configuring an IP Extended Community List	219
Filtering Routes with Community Lists	220
Manipulating the COMMUNITY Attribute	220
Changing MED Attributes	222
Changing the LOCAL_PREFERENCE Attribute	222
Changing the NEXT_HOP Attribute	223
Changing the WEIGHT Attribute	224
Enabling Multipath	224
Filtering BGP Routes	224
Filtering BGP Routes Using Route Maps	226
Filtering BGP Routes Using AS-PATH Information	227
Configuring BGP Route Reflectors	227
Aggregating Routes	228
Configuring BGP Confederations	229
Enabling Route Flap Dampening	229
Changing BGP Timers	232
Enabling BGP Neighbor Soft-Reconfiguration	232
Route Map Continue	234
Enabling MBGP Configurations	234
BGP Regular Expression Optimization	235
Debugging BGP	235
Storing Last and Bad PDUs	236
Capturing PDUs	237
PDU Counters	238
Sample Configurations	239
Content Addressable Memory (CAM)	245
CAM Allocation	245
Test CAM Usage	247
View CAM Profiles	247
View CAM-ACL Settings	248
View CAM Usage	250
CAM Optimization	251
Troubleshoot CAM Profiling	251
CAM Profile Mismatches	251
QoS CAM Region Limitation	251
Control Plane Policing (CoPP)	253
Configure Control Plane Policing	254
Configuring CoPP for Protocols	255
Configuring CoPP for CPU Queues	257
CoPP for OSPFv3 Packets	258
Configuring CoPP for OSPFv3	261
Show Commands	262
Data Center Bridging (DCB)	264
Ethernet Enhancements in Data Center Bridging	264
Priority-Based Flow Control	265
Enhanced Transmission Selection	266
Data Center Bridging Exchange Protocol (DCBx)	268
Data Center Bridging in a Traffic Flow	269
Enabling Data Center Bridging	269
QoS dot1p Traffic Classification and Queue Assignment	270
Configuring Priority-Based Flow Control	271
Configuring Lossless Queues	273
Configuring the PFC Buffer in a Switch Stack	274
Configure Enhanced Transmission Selection	275
ETS Prerequisites and Restrictions	275
Creating a QoS DCB Output Policy	276
Creating an ETS Priority Group	277
Applying an ETS Output Policy for a Priority Group to an Interface	278
ETS Operation with DCBx	280
Configuring Bandwidth Allocation for DCBx CIN	280
Applying DCB Policies in a Switch Stack	281
Applying DCB Policies with an ETS Configuration	281
Configure a DCBx Operation	282
DCBx Operation	282
DCBx Port Roles	283
DCB Configuration Exchange	284
Configuration Source Election	285
Propagation of DCB Information	285
Auto-Detection and Manual Configuration of the DCBx Version	286
DCBx Example	286
DCBx Prerequisites and Restrictions	287
Configuring DCBx	287
Verifying the DCB Configuration	291
PFC and ETS Configuration Examples	302
Using PFC and ETS to Manage Data Center Traffic	303
PFC and ETS Configuration Command Examples	304
Using PFC and ETS to Manage Converged Ethernet Traffic in a Switch Stack	305
Hierarchical Scheduling in ETS Output Policies	306
Configuring DCB Maps and its Attributes	306
DCB Map: Configuration Procedure	306
Important Points to Remember	307
Applying a DCB Map on a Port	308
Configuring PFC without a DCB Map	308
Configuring Lossless Queues	309
Priority-Based Flow Control Using Dynamic Buffer Method	310
Pause and Resume of Traffic	310
Buffer Sizes for Lossless or PFC Packets	311
Interworking of DCB Map With DCB Buffer Threshold Settings	311
Configuring the Dynamic Buffer Method	312
Dynamic Host Configuration Protocol (DHCP)	314
DHCP Packet Format and Options	314
Assign an IP Address using DHCP	316
Implementation Information	317
Configure the System to be a DHCP Server	318
Configuring the Server for Automatic Address Allocation	318
Specifying a Default Gateway	320
Configure a Method of Hostname Resolution	320
Using DNS for Address Resolution	320
Using NetBIOS WINS for Address Resolution	320
Creating Manual Binding Entries	321
Debugging the DHCP Server	321
Using DHCP Clear Commands	321
Configure the System to be a Relay Agent	322
Configure the System to be a DHCP Client	324
DHCP Client Operation with Other Features	324
DHCP Client on a Management Interface	325
Configure the System for User Port Stacking (Option 230)	326
Configure Secure DHCP	326
Option 82	326
DHCP Snooping	327
Drop DHCP Packets on Snooped VLANs Only	329
Dynamic ARP Inspection	329
Configuring Dynamic ARP Inspection	331
Source Address Validation	332
Enabling IP Source Address Validation	332
DHCP MAC Source Address Validation	332
Enabling IP+MAC Source Address Validation	333
Equal Cost Multi-Path (ECMP)	334
ECMP for Flow-Based Affinity	334
Configuring the Hash Algorithm	334
Enabling Deterministic ECMP Next Hop	334
Configuring the Hash Algorithm Seed	335
Link Bundle Monitoring	335
Managing ECMP Group Paths	336
Creating an ECMP Group Bundle	337
Modifying the ECMP Group Threshold	337
FCoE Transit	339
Fibre Channel over Ethernet	339
Ensure Robustness in a Converged Ethernet Network	339
FIP Snooping on Ethernet Bridges	341
FIP Snooping in a Switch Stack	343
Using FIP Snooping	343
FIP Snooping Prerequisites	343
Important Points to Remember	344
Enabling the FCoE Transit Feature	344
Enable FIP Snooping on VLANs	345
Configure the FC-MAP Value	345
Configure a Port for a Bridge-to-Bridge Link	345
Configure a Port for a Bridge-to-FCF Link	345
Impact on Other Software Features	345
FIP Snooping Restrictions	346
Configuring FIP Snooping	346
Displaying FIP Snooping Information	347
FCoE Transit Configuration Example	353
Enabling FIPS Cryptography	355
Configuration Tasks	355
Preparing the System	355
Enabling FIPS Mode	356
Generating Host-Keys	356
Monitoring FIPS Mode Status	357
Disabling FIPS Mode	357
Force10 Resilient Ring Protocol (FRRP)	359
Protocol Overview	359
Ring Status	360
Multiple FRRP Rings	361
Important FRRP Points	361
Important FRRP Concepts	361
Implementing FRRP	363
FRRP Configuration	363
Creating the FRRP Group	363
Configuring the Control VLAN	364
Configuring and Adding the Member VLANs	365
Setting the FRRP Timers	366
Clearing the FRRP Counters	367
Viewing the FRRP Configuration	367
Viewing the FRRP Information	367
Troubleshooting FRRP	368
Configuration Checks	368
Sample Configuration and Topology	368
GARP VLAN Registration Protocol (GVRP)	370
Important Points to Remember	370
Configure GVRP	371
Related Configuration Tasks	371
Enabling GVRP Globally	372
Enabling GVRP on a Layer 2 Interface	372
Configure GVRP Registration	372
Configure a GARP Timer	373
RPM Redundancy	374
High Availability (HA)	375
Component Redundancy	375
RPM Redundancy	375
Automatic and Manual Stack Unit Failover	377
Support for RPM Redundancy by Dell Networking OS Version	378
Synchronization between Management and Standby Units	378
Configuring RPM Redundancy	378
Online Insertion and Removal	380
RPM Online Insertion and Removal	380
Linecard Online Insertion and Removal	380
Hitless Behavior	381
Graceful Restart	382
Software Resiliency	382
Software Component Health Monitoring	382
System Health Monitoring	383
Failure and Event Logging	383
Hot-Lock Behavior	384
Process Restartability	384
Enabling Process Restartability	384
Internet Group Management Protocol (IGMP)	386
IGMP Implementation Information	386
IGMP Protocol Overview	386
IGMP Version 2	386
IGMP Version 3	388
Configure IGMP	391
Related Configuration Tasks	391
Viewing IGMP Enabled Interfaces	392
Selecting an IGMP Version	392
Viewing IGMP Groups	393
Adjusting Timers	393
Adjusting Query and Response Timers	393
Adjusting the IGMP Querier Timeout Value	394
Configuring a Static IGMP Group	394
Enabling IGMP Immediate-Leave	395
IGMP Snooping	395
IGMP Snooping Implementation Information	395
Configuring IGMP Snooping	395
Removing a Group-Port Association	396
Disabling Multicast Flooding	396
Specifying a Port as Connected to a Multicast Router	397
Configuring the Switch as Querier	397
Fast Convergence after MSTP Topology Changes	398
Egress Interface Selection (EIS) for HTTP and IGMP Applications	398
Protocol Separation	399
Enabling and Disabling Management Egress Interface Selection	400
Handling of Management Route Configuration	401
Handling of Switch-Initiated Traffic	401
Handling of Switch-Destined Traffic	402
Handling of Transit Traffic (Traffic Separation)	403
Mapping of Management Applications and Traffic Type	403
Behavior of Various Applications for Switch-Initiated Traffic	404
Behavior of Various Applications for Switch-Destined Traffic	405
Interworking of EIS With Various Applications	406
Designating a Multicast Router Interface	407
Interfaces	408
Basic Interface Configuration	408
Advanced Interface Configuration	408
Interface Types	409
View Basic Interface Information	409
Enabling a Physical Interface	411
Physical Interfaces	411
Configuration Task List for Physical Interfaces	412
Overview of Layer Modes	412
Configuring Layer 2 (Data Link) Mode	412
Configuring Layer 2 (Interface) Mode	413
Configuring Layer 3 (Network) Mode	413
Configuring Layer 3 (Interface) Mode	414
Egress Interface Selection (EIS)	414
Important Points to Remember	415
Configuring EIS	415
Management Interfaces	415
Configuring Management Interfaces	415
Configuring Management Interfaces on the S-Series	416
VLAN Interfaces	417
Loopback Interfaces	418
Null Interfaces	418
Port Channel Interfaces	418
Port Channel Definition and Standards	419
Port Channel Benefits	419
Port Channel Implementation	419
10/100/1000 Mbps Interfaces in Port Channels	420
Configuration Tasks for Port Channel Interfaces	420
Creating a Port Channel	420
Adding a Physical Interface to a Port Channel	421
Reassigning an Interface to a New Port Channel	423
Configuring the Minimum Oper Up Links in a Port Channel	424
	424
Assigning an IP Address to a Port Channel	425
Deleting or Disabling a Port Channel	425
Load Balancing Through Port Channels	425
Load-Balancing on the S- Series	425
Changing the Hash Algorithm	426
Bulk Configuration	427
Interface Range	427
Bulk Configuration Examples	428
Defining Interface Range Macros	429
Define the Interface Range	430