Example of Permitting Only First Fragments and Non-Fragmented Packets from a Specified Host
In the following example, the TCP packets that are first fragments or non-fragmented from host 10.1.1.1 with
TCP destination port equal to 24 are permitted. Additionally, all TCP non-first fragments from host 10.1.1.1 are
permitted. All other IP packets that are non-first fragments are denied.
Dell(conf)#ip access-list extended ABC
Dell(conf-ext-nacl)#permit tcp host 10.1.1.1 any eq 24
Dell(conf-ext-nacl)#permit tcp host 10.1.1.1 any fragment
Dell(conf-ext-nacl)#
deny ip any any fragment
Dell(conf-ext-nacl)
Example of Logging Denied Packets
To log all the packets denied and to override the implicit deny rule and the implicit permit rule for TCP/ UDP
fragments, use a configuration similar to the following.
Dell(conf)#ip access-list extended ABC
Dell(conf-ext-nacl)#permit tcp any any fragment
Dell(conf-ext-nacl)#permit udp any any fragment
Dell(conf-ext-nacl)#
deny ip any any log
Dell(conf-ext-nacl)
When configuring ACLs with the fragments keyword, be aware of the following.
When an ACL filters packets, it looks at the fragment offset (FO) to determine whether it is a fragment.
• FO = 0 means it is either the first fragment or the packet is a non-fragment.
• FO > 0 means it is dealing with the fragments of the original packet.
Configure a Standard IP ACL
To configure an ACL, use commands in IP ACCESS LIST mode and INTERFACE mode.
For a complete list of all the commands related to IP ACLs, refer to the
Dell Networking OS Command Line
Interface Reference Guide
. To set up extended ACLs, refer to
A standard IP ACL uses the source IP address as its match criterion.
1
Enter IP ACCESS LIST mode by naming a standard IP access list.
CONFIGURATION mode
ip access-list standard
access-listname
2 Configure a drop or forward filter.
CONFIG-STD-NACL mode
seq
sequence-number
{deny | permit} {
source
[
mask
] | any | host
ip-address
}
[count [byte] [dscp] [order] [fragments]
NOTE:
When assigning sequence numbers to filters, keep in mind that you might need to insert a new
filter. To prevent reconfiguring multiple filters, assign sequence numbers in multiples of five.
To view the rules of a particular ACL configured on a particular interface, use the
show ip accounting
access-list
ACL-name
interface
interface
command in EXEC Privilege mode.
Access Control Lists (ACLs)
150
Summary of Contents for S4048T
Page 1: ...Dell Configuration Guide for the S4048T ON System 9 10 0 1 ...
Page 98: ... saveenv 7 Reload the system uBoot mode reset Management 98 ...
Page 113: ...Total CFM Pkts 10303 CCM Pkts 0 LBM Pkts 0 LTM Pkts 3 LBR Pkts 0 LTR Pkts 0 802 1ag 113 ...
Page 411: ...mode transit no disable Force10 Resilient Ring Protocol FRRP 411 ...
Page 590: ...Figure 67 Inspecting the LAG Configuration Link Aggregation Control Protocol LACP 590 ...
Page 646: ...Figure 87 Configuring Interfaces for MSDP Multicast Source Discovery Protocol MSDP 646 ...
Page 647: ...Figure 88 Configuring OSPF and BGP for MSDP Multicast Source Discovery Protocol MSDP 647 ...
Page 653: ...Figure 91 MSDP Default Peer Scenario 2 Multicast Source Discovery Protocol MSDP 653 ...
Page 654: ...Figure 92 MSDP Default Peer Scenario 3 Multicast Source Discovery Protocol MSDP 654 ...
Page 955: ...Figure 119 Single and Double Tag First byte TPID Match Service Provider Bridging 955 ...
