Deployment Guide

Conguring Filters Without a Sequence Number
If you are creating an extended ACL with only one or two lters, you can let the system assign a sequence number based on the order in
which the lters are congured. The system assigns lters in multiples of ve.
To congure a lter for an extended IP ACL without a specied sequence number, use any or all of the following commands:
• Congure a deny or permit lter to examine IP packets.
CONFIG-EXT-NACL mode
{deny | permit} {source mask | any | host ip-address} [count [byte]] [order] [fragments]
• Congure a deny or permit lter to examine TCP packets.
CONFIG-EXT-NACL mode
{deny | permit} tcp {source mask] | any | host ip-address}} [count [byte]] [order] [fragments]
• Congure a deny or permit lter to examine UDP packets.
CONFIG-EXT-NACL mode
{deny | permit} udp {source mask | any | host ip-address}} [count [byte]] [order] [fragments]
The following example shows an extended IP ACL in which the sequence numbers were assigned by the software. The lters were
assigned sequence numbers based on the order in which they were congured (for example, the rst lter was given the lowest sequence
number). The show config command in IP ACCESS LIST mode displays the two lters with the sequence numbers 5 and 10.
Example of Viewing Filter Sequence for a Specied Extended ACL
Dell(config-ext-nacl)#deny tcp host 123.55.34.0 any
Dell(config-ext-nacl)#permit udp 154.44.123.34 0.0.255.255 host 34.6.0.0
Dell(config-ext-nacl)#show config
!
ip access-list extended nimule
seq 5 deny tcp host 123.55.34.0 any
seq 10 permit udp 154.44.0.0 0.0.255.255 host 34.6.0.0
Dell(config-ext-nacl)#
To view all congured IP ACLs and the number of packets processed through the ACL, use the show ip accounting access-list
command in EXEC Privilege mode, as shown in the rst example in Conguring a Standard IP ACL Filter.
Established Flag
To obtain the functionality of est, use the following ACLs:
• permit tcp any any rst
• permit tcp any any ack
Congure Layer 2 and Layer 3 ACLs
Both Layer 2 and Layer 3 ACLs may be congured on an interface in Layer 2 mode.
If both L2 and L3 ACLs are applied to an interface, the following rules apply:
• When the system routes the packets, only the L3 ACL governs them because they are not ltered against an L2 ACL.
• When the system switches the packets, rst the L3 ACL lters them, then the L2 ACL lters them.
• When the system switches the packets, the egress L3 ACL lters the packet.
For the following features, if you enable counters on rules that have already been congured and a new rule is either inserted or prepended,
all the existing counters are reset:
Access Control Lists (ACLs)
117