Home » Dell Manuals » Servers » Dell S5000 » Manual Viewer

Dell S5000 FTOS 9.0(1.3) Configuration Guide for the Switch - Page 116

Test CAM Usage, Implementing ACLs on FTOS, ACLs and VLANs

Add to My Manuals
Save this manual to your list of manuals

Page 116 highlights

www.dell.com | support.dell.com Test CAM Usage The test cam-usage command is supported on the S5000 platform. This command applies to the IPv4 ingress CAM partition. Use this command to determine if sufficient ACL CAM space is available to enable a service-policy. Create a Class Map with all required ACL rules, then execute the test cam-usage command in Privilege mode to verify the actual CAM space required. The example below gives a sample of the output shown when executing the command. The status column indicates whether or not the policy can be enabled. Figure 7-1. Command Example: test cam-usage ) FTOS#test cam-usage service-policy input TestPolicy stack-unit all Stack-unit | Portpipe | CAM Partition | Available CAM | Estimated CAM per Port | Status 2 | 1 | IPv4Flow | 232 | 0 | Allowed 2 | 1 | IPv6Flow | 0 | 0 | Allowed 4 | 0 | IPv4Flow | 232 | 0 | Allowed 4 | 0 | IPv6Flow | 0 | 0 | Allowed FTOS# Implementing ACLs on FTOS You can assign one IP ACL per interface with FTOS. If an IP ACL is not assigned to an interface, it is not used by the software in any other capacity. The number of entries allowed per ACL is hardware-dependent. If counters are enabled on IP ACL rules that are already configured, those counters are reset when a new rule is inserted or prepended. If a rule is appended, the existing counters are not affected. This is applicable to the following features: • L2 Ingress Access list • L2 Egress Access list • L3 Ingress Access list • L3 Egress Access list Note: IP ACLs are supported over VLANs in Version 6.2.1.1 and higher. V ACLs and VLANs There are some differences when assigning ACLs to a VLAN rather than a physical port. For example, when using a single port-pipe, if you apply an ACL to a VLAN, one copy of the ACL entries would get installed in the ACL CAM on the port-pipe. The entry would look for the incoming VLAN in the packet. Whereas if you apply an ACL on individual ports of a VLAN, separate copies of the ACL entries would be installed for each port belonging to a port-pipe. 116 | Access Control Lists (ACLs)

Section	Page
About this Guide	29
Objectives	29
Audience	29
Conventions	29
Related Documents	30
Configuration Fundamentals	31
Accessing the Command Line	31
CLI Modes	32
Navigating CLI Modes	34
Port Numbering Convention	36
The do Command	37
The no Command	37
Obtaining Help	38
Entering and Editing Commands	39
Command History	40
Filtering show Command Outputs	40
Multiple Users in Configuration mode	42
Getting Started	43
Accessing Ports	44
Accessing the RJ-45/RS-232 Console Port	44
Accessing the RJ-45 console port with a DB-9 adapter	45
Accessing the USB-B Console Port	45
Booting Process	47
Entering the Initial Configuration Information	49
Configuring the Enable Password	50
Configuring a Host Name	51
Navigating CLI Modes	51
Default Configuration	51
Configuring Layer 2 (Data Link) Mode	51
Accessing the System Remotely	52
Configuring the Management Port IP Address	52
Configuring a Management Route	53
Configuring a Username and Password	53
Creating a Port-based VLAN	53
Assigning Interfaces to a VLAN	54
Assigning an IP Address to a VLAN	55
Connecting the S5000 to the Network	55
Configuring File Management	55
Copying Files to and from the System	56
Important Points to Remember	56
Saving the Running-configuration	57
Configuring the Overload bit for Startup Scenario	58
Viewing Files	58
Viewing Configuration Files	59
File System Management	60
Viewing command history	61
Upgrading and Downgrading FTOS	62
Switch Management	63
Configuring Privilege Levels	64
Creating a Custom Privilege Level	64
Removing a command from EXEC mode	64
Moving a command from EXEC privilege mode to EXEC mode	64
Allowing Access to CONFIGURATION mode commands	64
Allowing Access to INTERFACE, LINE, ROUTE-MAP, and ROUTER modes	65
Applying a Privilege Level to a Username	67
Applying a Privilege Level to a Terminal Line	67
Configuring Logging	67
Disabling Logging	67
Log Messages in the Internal Buffer	68
Configuring Task List for System Log Management	68
Disabling System Logging	68
Sending System Messages to a Syslog Server	68
Configuring a Unix System as a Syslog Server	68
Changing System Logging Settings	69
Displaying the Logging Buffer and the Logging Configuration	70
Configuring a UNIX logging facility level	71
Synchronizing log messages	72
Enabling timestamp on syslog messages	72
File Transfer Services	73
Configuring Task List for File Transfer Services	73
Enabling FTP server	73
Configuring FTP server parameters	74
Configuring FTP client parameters	74
Terminal Lines	75
Denying and Permitting Access to a Terminal Line	75
Configuring Login Authentication for Terminal Lines	76
Timing out of EXEC Privilege Mode	77
Telneting to Another Network Device	78
Locking CONFIGURATION mode	78
Viewing the Configuration Lock Status	79
Recovering from a Forgotten Password	80
Recovering from a Forgotten Enable Password	80
Recovering from a Failed Start	81
802.1ag	83
Ethernet CFM	84
Maintenance Domains	84
Maintenance Points	85
Maintenance End Points	86
Implementation Information	86
Configuring CFM	86
Related Configuration Tasks	87
Enabling Ethernet CFM	87
Creating a Maintenance Domain	87
Creating a Maintenance Association	88
Creating Maintenance Points	88
Creating a Maintenance End Point	88
Creating a Maintenance Intermediate Point	89
MP Databases	89
Continuity Check Messages	90
Enabling CCM	92
Enabling Cross-checking	92
Loopback Message and Response	92
Linktrace Message and Response	92
Enabling Link Trace Cache	93
Enabling CFM SNMP Traps	94
Displaying Ethernet CFM Statistics	95
802.1X	97
Protocol Overview	97
Port-authentication Process	99
EAP over RADIUS	100
RADIUS Attributes for 802.1 Support	100
Configuring 802.1X	101
Related Configuration Tasks	101
Important Points to Remember	101
Enabling 802.1X	101
Configuring Request Identity Re-transmissions	103
Configuring a Quiet Period after a Failed Authentication	104
Forcibly Authorizing or Unauthorizing a Port	105
Re-authenticating a Port	106
Periodic Re-authentication	106
Configuring Timeouts	107
Dynamic VLAN Assignment with Port Authentication	108
Guest and Authentication-fail VLANs	109
Configuring a Guest VLAN	110
Configuring an Authentication-fail VLAN	110
Access Control Lists (ACLs)	113
Overview	113
IP Access Control Lists (ACLs)	114
CAM Allocation and CAM Optimization	115
User-Configurable CAM Allocation	115
CAM optimization	115
Test CAM Usage	116
Implementing ACLs on FTOS	116
ACLs and VLANs	116
ACL Optimization	117
Determine the Order in Which ACLs are Used to Classify Traffic	117
IP Fragment Handling	118
IP Fragments ACL Examples	118
Layer 4 ACL Rules Examples	119
Configuring a Standard IP ACL	120
Configuring an Extended IP ACL	123
Configuring filters with a Sequence Number	123
Configuring Filters without a Sequence Number	124
Established Flag	125
To obtain the functionality of est, use the following ACLs:	125
Configuring Layer 2 and Layer 3 ACLs on an Interface	125
Assigning an IP ACL to an Interface	126
Counting ACL Hits	127
Configuring Ingress ACLs	127
Configuring Egress ACLs	128
Egress Layer 3 ACL Lookup for Control-plane IP Traffic	129
Configuring ACLs to Loopback	130
Applying an ACL on Loopback Interfaces	130
IP Prefix Lists	131
Implementation Information	132
Configuration Task List for Prefix Lists	132
Configuring a prefix list	132
Using a prefix list for route redistribution	135
ACL Resequencing	136
Resequencing an ACL or Prefix List	137
Route Maps	138
Implementation Information	138
Important Points to Remember	138
Configuration Task List for Route Maps	139
Creating a route map	139
Configuring Route Map Filters	141
Configuring a route map for route redistribution	143
Configuring a route map for route tagging	144
Continue clause	145
Bidirectional Forwarding Detection (BFD)	147
Protocol Overview	147
How BFD Works	148
Configuring Bidirectional Forwarding Detection	153
Configuring BFD for Physical Ports	154
Changing physical port session parameters	157
Configuring BFD for Static Routes	158
Configuring BFD for OSPF	160
Configuring BFD for IS-IS	163
Configuring BFD for BGP	165
Configuring BFD for VRRP	173
Configuring BFD for VLANs	176
Changing session parameters	177
Configuring BFD for Port-Channels	178
Changing port-channel session parameters	180
Configuring Protocol Liveness	180
Troubleshooting BFD	181
Border Gateway Protocol IPv4 (BGPv4)	183
Protocol Overview	184
Autonomous Systems (AS)	184
Sessions and Peers	186
Route Reflectors	187
Confederations	188
BGP Attributes	189
Best Path Selection Criteria	189
Weight	192
Local Preference	192
Origin	193
AS Path	194
Next Hop	195
Multiprotocol BGP	195
Implementing BGP with FTOS	195
Additional Path (Add-Path) support	195
Advertising IGP cost as MED for redistributed routes	195
Ignoring Router-ID for some best-path calculations	196
4-Byte AS Numbers	197
AS4 Number Representation	197
AS Number Migration	200
BGP4 Management Information Base (MIB)	202
Important Points to Remember	202
Configuration Information	203
BGP Configuration	204
Configuration Task List for BGP	204
MBGP Configuration	246
BGP Regular Expression Optimization	247
Debugging BGP	247
Storing Last and Bad PDUs	248
Capturing PDUs	250
PDU Counters	251
Sample Configurations	251
Bare Metal Provisioning 2.0	263
Prerequisites	264
Restrictions	264
Overview	264
Jumpstart mode	265
DHCP Server	265
File Server	268
Domain Name Server	269
Switch boot and set-up behavior in Jumpstart Mode	269
Content Addressable Memory (CAM)	273
Content Addressable Memory	273
CAM Allocation	273
Re-allocating CAM for Ingress ACLs and QoS	274
Re-allocating CAM for Egress ACLs	275
Testing CAM Usage for QoS Policies	275
Displaying CAM-ACL Settings	276
Displaying CAM-ACL-Egress Settings	277
CAM Optimization	277
Control Plane Policing (CoPP)	279
Overview	279
Configuring Control Plane Policing	280
Configuring CoPP for protocols	281
Sample Config for CoPP protocol configuration	282
Configuring CoPP for CPU queues	283
Sample Config for CoPP CPU queue configuration	283
Show commands	284
Data Center Bridging (DCB)	287
Ethernet Enhancements in Data Center Bridging	287
Priority-Based Flow Control	288
Enhanced Transmission Selection	289
Data Center Bridging Exchange Protocol	291
Data Center Bridging in a Traffic Flow	291
Data Center Bridging: Default Configuration	292
Enabling Data Center Bridging	292
QoS dot1p Traffic Classification and Queue Assignment	293
Configuring PFC and ETS in a DCB Map	294
PFC Configuration Notes	294
PFC Prerequisites and Restrictions	295
ETS Configuration Notes	296
ETS Prerequisites and Restrictions	297
Priority-Group Configuration Notes	297
DCB Map: Configuration Procedure	297
Applying a DCB Map on a Port	299
Configuring PFC without a DCB Map	299
Configuring Lossless Queues	300
ETS Operation with DCBx	301
Configuring Bandwidth Allocation for DCBx CIN	302
Applying a DCB Map in a Switch Stack	302
Configuring DCBx Operation	303
Supported DCBx Versions	303
DCBx Operation	303
DCBx Port Roles	304
DCB Configuration Exchange	305
Configuration Source Election	306
Propagation of DCB Information	306
Auto-Detection and Manual Configuration of the DCBx Version	307
DCBx Example	308
DCBx Prerequisites and Restrictions	309
DCBx Configuration Procedure	310
Verifying DCB Configuration	313
PFC and ETS Configuration Examples	325
Using PFC and ETS to Manage Data Center Traffic	325
Using PFC and ETS to Manage Converged Ethernet Traffic in a Switch Stack	329
Hierarchical Scheduling in ETS Configuration	329
Troubleshooting PFC, ETS, and DCBx Operation	330
DCBx Oper Status is Down	330
DCBx Error Messages	331
Debugging DCBx on an Interface	332
Dynamic Host Configuration Protocol (DHCP)	333
Protocol Overview	333
DHCP Packet Format and Options	334
Assigning an IP Address using DHCP	335
Implementation Information	336
Configuration Tasks	336
Configuring the System to be a DHCP Server	336
Configuration Tasks	337
Related Configuration Tasks	337
Configuring the Server for Automatic Address Allocation	337
Specifying a Default Gateway	338
Enabling DHCP Server	339
Configuring a Method of Hostname Resolution	339
Creating Manual Binding Entries	340
Debugging DHCP server	341
DHCP Clear Commands	341
Configuring the System to be a Relay Agent	341
Configuring the System for User Port Stacking	342
Configuring Secure DHCP	343
Option 82	343
DHCP Snooping	344
Dropping DHCP packets on snooped VLANs only	346
Dynamic ARP Inspection	347
Source Address Validation	349
Equal Cost Multi-Path (ECMP)	353
ECMP for Flow-based Affinity	353
Deterministic ECMP Next Hop	353
Configuring Hash Algorithm Seed	354
Link Bundle Monitoring	354
Managing ECMP Group Paths	355
FCoE Transit	357
Fibre Channel over Ethernet	357
Ensuring Robustness in a Converged Ethernet Network	357
FIP Snooping on Ethernet Bridges	359
Configuring FIP Snooping	361
Enabling the FCoE Transit Feature	361
Enabling FIP Snooping on VLANs	362
Configuring the FC-MAP Value	363
Configuring a Port for a Bridge-to-FCF Link	363
FIP Snooping on an NPIV Proxy Gateway	363
FIP Snooping in an S5000 Stack	363
Impact on Other Software Features	364
FIP Snooping Prerequisites	364
FIP Snooping Restrictions	365
FIP Snooping Configuration Procedure	366
Displaying FIP Snooping Information	367
FCoE Transit Configuration Example	372
Force10 Resilient Ring Protocol (FRRP)	375
Protocol Overview	375
Ring Status	376
Multiple FRRP Rings	377
Important FRRP Points	379
Important FRRP Concepts	379
Implementing FRRP	380
Configuring FRRP	381
Troubleshooting FRRP	385
Configuration Checks	385
Sample Configuration and Topology	385
GARP VLAN Registration Protocol (GVRP)	387
Protocol Overview	387
Important Points to Remember	387
Configuring GVRP	388
Related Configuration Tasks	389
Enabling GVRP Globally	389
Enabling GVRP on a Layer 2 Interface	390
Configuring GVRP Registration	390
Configuring a GARP Timer	391
High Availability	393
High Availability on S5000 Stacks	393
Hitless Behavior	393
Graceful Restart	394
Software Resiliency	394
System Health Monitoring	394
Failure and Event Logging	394
Hot-lock Behavior	395
Internet Group Management Protocol (IGMP)	397
IGMP Implementation Information	397
IGMP Protocol Overview	398
IGMP version 2	398
IGMP version 3	399
Configuring IGMP	402
Related Configuration Tasks	402
Viewing IGMP Enabled Interfaces	402
Selecting an IGMP Version	403
Viewing IGMP Groups	403
Adjusting Timers	404
Adjusting Query and Response Timers	404
Adjusting the IGMP Querier Timeout Value	404
Configuring a Static IGMP Group	405
Enabling IGMP Immediate-leave	405
IGMP Snooping	405
IGMP Snooping Implementation Information	406
Configuring IGMP Snooping	406
Enabling IGMP Immediate-leave	406
Disabling Multicast Flooding	407
Specifying a Port as Connected to a Multicast Router	407
Configuring the Switch as Querier	407
Fast Convergence after MSTP Topology Changes	408
Designating a Multicast Router Interface	408
Interfaces	409
Basic Interface Configuration:	409
Advanced Interface Configuration:	409
Interface Types	410
Viewing Basic Interface Information	410
Enabling a Physical Interface	413
Physical Interfaces	413
Configuration Task List for Physical Interfaces	414
Overview of Layer Modes	414
Configuring Layer 2 (Data Link) Mode	414
Configuring Layer 3 (Network) Mode	415
Management Interfaces	417
Configuring a Management Interface	417
Important Things to Remember — virtual-ip	418
Displaying a Management Interface Configuration	419
VLAN Interfaces	420
Loopback Interfaces	421
Port Channel Interfaces	421
Port channel definition and standards	421
Port channel benefits	422
Port channel implementation	422
1G/10G interfaces in port channels	422
Configuration task list for port channel interfaces	423
Creating a port channel	423
Adding a physical interface to a port channel	424
Reassigning an interface to a new port channel	426
Configuring the minimum oper up links in a port channel (LAG)	427
Adding or removing a port channel from a VLAN	428
Assigning an IP address to a port channel	428
Deleting or disabling a port channel	429
Load balancing through port channels	429
S5000 load-balancing	429
Hash algorithm	430
Bulk Configuration	431
Interface Range	431
Bulk Configuration Examples	431
Interface Range Macros	433
Defining the Interface Range	433
Choosing an Interface-range Macro	434
Monitoring and Maintaining Interfaces	434
Splitting QSFP ports to SFP+ ports	436
Important Points	436
Link Dampening	437
Important Points to Remember	437
Enabling Link Dampening	437
Link Bundle Monitoring	439
Using Ethernet Pause Frames for Flow Control	440
Configuring MTU Size on an Interface	441
Adjusting the keepalive timer	442
Viewing Advanced Interface Information	442
Displaying Only Configured Interfaces	442
Configuring Interface Sampling Size	443
Dynamic Counters	445
Clearing interface counters	446
Fibre Channel Interfaces	447
Configuring Fibre Channel Interfaces	447
Enabling Fibre Channel Capability	447
Configuring Fibre Channel Interfaces	447
Displaying Fibre Channel Information	448
Troubleshooting Fibre Channel Operation	452
IPv4 Routing	455
IP Addresses	456
Implementation Information	456
Configuration Task List for IP Addresses	456
Directed Broadcast	460
Resolution of Host Names	460
ARP	463
Configuration Task List for ARP	463
ARP Learning via Gratuitous ARP	465
ARP Learning via ARP Request	465
Configuring ARP Retries	466
ICMP	466
Configuration Task List for ICMP	466
UDP Helper	467
Configuring UDP Helper	467
Important Points to Remember about UDP Helper	467
Enabling UDP Helper	468
Configuring a Broadcast Address	468
Configurations Using UDP Helper	469
UDP Helper with Broadcast-all Addresses	469
UDP Helper with Subnet Broadcast Addresses	470
UDP Helper with Configured Broadcast Addresses	470
UDP Helper with No Configured Broadcast Addresses	471
Troubleshooting UDP Helper	471
iSCSI Optimization	473
iSCSI Optimization Overview	473
Monitoring iSCSI Traffic Flows	475
Application of Quality of Service to iSCSI Traffic Flows	475
Information Monitored in iSCSI Traffic Flows	475
Detection and Auto-configuration for Dell EqualLogic Arrays	476
Detection and Port Configuration for Dell Compellent Arrays	476
Enabling and Disabling iSCSI Optimization	477
Default iSCSI Optimization Values	478
iSCSI Optimization Prerequisites	478
Configuring iSCSI Optimization	479
Displaying iSCSI Optimization Information	480
Intermediate System to Intermediate System	483
Protocol Overview	483
IS-IS Addressing	484
Multi-Topology IS-IS	484
Transition Mode	485
Interface support	485
Adjacencies	485
Graceful Restart	486
Timers	486
Implementation Information	487
Configuration Information	488
Configuration Task List for IS-IS	488
Configuring the distance of a route	498
Changing the IS-type	498
IS-IS Metric Styles	505
Configuring Metric Values	506
Maximum Values in the Routing Table	506
Changing the IS-IS Metric Style in One Level Only	506

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1,000
1,001
1,002
1,003
1,004
1,005
1,006
1,007
1,008
1,009
1,010
1,011
1,012
1,013
1,014
1,015
1,016
1,017
1,018
1,019
1,020
1,021
1,022
1,023
1,024
1,025
1,026
1,027
1,028
1,029
1,030
1,031
1,032
1,033
1,034
1,035
1,036
1,037
1,038
1,039
1,040
1,041
1,042
1,043
1,044
1,045
1,046
1,047
1,048
1,049
1,050

Match case Limit results 1 per page

116

Access Control Lists (ACLs)

www.dell.com

support.dell.com

Test CAM Usage

The

test cam-usage

command is supported on the S5000 platform. This command applies to the IPv4

ingress CAM partition.

Use this command to determine if sufficient ACL CAM space is available to enable a service-policy.

Create a Class Map with all required ACL rules, then execute the

test cam-usage

command in Privilege

mode to verify the actual CAM space required. The example below gives a sample of the output shown

when executing the command. The status column indicates whether or not the policy can be enabled.

Figure 7-1.

Command Example: test cam-usage )

Implementing ACLs on FTOS

You can assign one IP ACL per interface with FTOS. If an IP ACL is not assigned to an interface, it is not

used by the software in any other capacity.

The number of entries allowed per ACL is hardware-dependent.

If counters are enabled on IP ACL rules that are already configured, those counters are reset when a new

rule is inserted or prepended. If a rule is appended, the existing counters are not affected. This is applicable

to the following features:

•

L2 Ingress Access list

•

L2 Egress Access list

•

L3 Ingress Access list

•

L3 Egress Access list

ACLs and VLANs

There are some differences when assigning ACLs to a VLAN rather than a physical port. For example,

when using a single port-pipe, if you apply an ACL to a VLAN, one copy of the ACL entries would get

installed in the ACL CAM on the port-pipe. The entry would look for the incoming VLAN in the packet.

Whereas if you apply an ACL on individual ports of a VLAN, separate copies of the ACL entries would be

installed for each port belonging to a port-pipe.

Note:

IP ACLs are supported over VLANs in Version 6.2.1.1 and higher.

FTOS#

test cam-usage service-policy input TestPolicy

stack-unit all

Status

------------------------------------------------------------------------------------------

2 |

1 | IPv4Flow

232 |

0 |

Allowed

2 |

1 | IPv6Flow

0 |

0 | Allowed

4 |

0 | IPv4Flow

232 |

0 | Allowed

4 |

0 | IPv6Flow

0 |

0 | Allowed

FTOS#