Concept Guide

• ACL Resequencing
• Resequencing an ACL or Prex List
• Route Maps
• Important Points to Remember
• Conguration Task List for Route Maps
• Creating a Route Map
• Congure Route Map Filters
• Conguring Match Routes
• Conguring Set Conditions
• Congure a Route Map for Route Redistribution
• Congure a Route Map for Route Tagging
• Continue Clause
• Logging of ACL Processes
• Guidelines for Conguring ACL Logging
• Conguring ACL Logging
• Flow-Based Monitoring Support for ACLs
• Enabling Flow-Based Monitoring
IP Access Control Lists (ACLs)
In Dell Networking switch/routers, you can create two dierent types of IP ACLs: standard or extended.
A standard ACL lters packets based on the source IP packet. An extended ACL lters trac based on the following criteria:
• IP protocol number
• Source IP address
• Destination IP address
• Source TCP port number
• Destination TCP port number
• Source UDP port number
• Destination UDP port number
For more information about ACL options, refer to the Dell Networking OS Command Reference Guide.
For extended ACL, TCP, and UDP lters, you can match criteria on specic or ranges of TCP or UDP ports. For extended ACL TCP lters,
you can also match criteria on established TCP sessions.
When creating an access list, the sequence of the lters is important. You have a choice of assigning sequence numbers to the lters as
you enter them, or the Dell Networking operating system assigns numbers in the order the lters are created. The sequence numbers are
listed in the display output of the show config and show ip accounting access-list commands.
Ingress and egress hot lock ACLs allow you to append or delete new rules into an existing ACL (already written into CAM) without
disrupting trac ow. Existing entries in the CAM are shued to accommodate the new entries. Hot lock ACLs are enabled by default and
support both standard and extended ACLs.
NOTE
: Hot lock ACLs are supported for Ingress ACLs only.
Implementing ACL on the Dell Networking OS
You can assign one IP ACL per interface. If you do not assign an IP ACL to an interface, it is not used by the software.
The number of entries allowed per ACL is hardware-dependent.
If counters are enabled on ACL rules that are already congured, those counters are reset when a new rule which is inserted or prepended
or appended requires a hardware shift in the ow table. Resetting the counters to 0 is transient as the proginal counter values are retained
Access Control Lists (ACLs)
113