Dell BigIron RX Series, Руководство по настройке

Страница: 644 / 1458

568 BigIron RX Series Configuration Guide
53-1002253-01
Enabling ACL filtering of fragmented or non-fragmented packets
21
Enabling ACL filtering of fragmented or non-fragmented
packets
By default, when an extended ACL is applied to a port, the port will use the ACL to permit or deny
the first fragment of a fragmented packet, but forward subsequent fragments of the same packet
in hardware. Generally, denying the first fragment of a packet is sufficient, since a transaction
cannot be completed without the entire packet.
To define an extended ACL to deny or permit traffic with fragmented or unfragmented packets,
enter a command such as those shown in one of the methods below.
Numbered ACLs
BigIron RX(config)# access-list 111 deny ip any any fragment
BigIron RX(config)# int eth 1/1
BigIron RX(config-if-e10000-1/1)# ip access-group 111 in
BigIron RX(config)# write memory
The first line in the example defines ACL 111 to deny any fragmented packets. Other packets will be
denied or permitted, based on the next filter condition.
Next, after assigning the ACL to Access Group 111, the access group is bound to port 1/1. It will be
used to filter incoming traffic.
Refer to “Extended ACL syntax” on page 533 for the complete syntax for extended ACLs.
Refer to “Super ACL syntax” on page 542 for the complete syntax for super ACLs.
Named ACLs
BigIron RX(config)# ip access-list extended entry deny ip any any fragment
BigIron RX(config)# int eth 1/1
BigIron RX(config-if-e10000-1/1)# ip access-group entry in
BigIron RX(config)# write memory
The first line in the example defines ACL entry to deny any fragmented packets. Other packets will
be denied or permitted, based on the next filter condition.
Next, after assigning the ACL to Access Group entry, the access group is bound to port 1/1. It will be
used to filter incoming traffic.
Syntax: ip access-list extended <acl-name> | <acl-num> deny | permit <ip-protocol> <source-ip>
| <hostname> <wildcard> [ <operator> <source-tcp/udp-port> ] <destination-ip> |
<hostname> [ <icmp-type> | <num> ] <wildcard>
[ <operator> <destination-tcp/udp-port> ] [precedence <name> | <num> ] [tos <name> |
<num> ] [ip-pkt-len <value> ] [log] [fragment] | [non-fragmented]
Enter extended to indicate the named ACL is an extended ACL.
The <acl-name> | <acl-num> parameter allows you to specify an ACL name or number. If using a
name, specify a string of up to 255 alphanumeric characters. You can use blanks in the ACL name,
if you enclose the name in quotation marks (for example, “ACL for Net1”). The
<acl-num>
parameter allows you to specify an ACL number if you prefer. If you specify a number, enter a
number from 100 – 199 for extended ACLs. You must always specify a number (from 500 – 599)
for super ACLs