Users Guide

Dell(conf)#ip access-list standard acl2
Dell(config-std-nacl)#permit 20.1.1.0/24 order 0
Dell(config-std-nacl)#exit
Dell(conf)#class-map match-all cmap1
Dell(conf-class-map)#match ip access-group acl1
Dell(conf-class-map)#exit
Dell(conf)#class-map match-all cmap2
Dell(conf-class-map)#match ip access-group acl2
Dell(conf-class-map)#exit
Dell(conf)#policy-map-input pmap
Dell(conf-policy-map-in)#service-queue 7 class-map cmap1
Dell(conf-policy-map-in)#service-queue 4 class-map cmap2
Dell(conf-policy-map-in)#exit
Dell(conf)#interface gig 1/0
Dell(conf-if-gi-1/0)#service-policy input pmap
IP Fragment Handling
The Dell Networking OS supports a congurable option to explicitly deny IP fragmented packets, especially second and subsequent
packets.
It extends the existing ACL command syntax with the fragments keyword for all Layer 3 rules applicable to all Layer protocols (permit/
deny ip/tcp/udp/icmp).
• Both standard and extended ACLs support IP fragments.
• Second and subsequent fragments are allowed because a Layer 4 rule cannot be applied to these fragments. If the packet is to be
denied eventually, the rst fragment would be denied and hence the packet as a whole cannot be reassembled.
• Implementing the required rules uses a signicant number of CAM entries per TCP/UDP entry.
• For IP ACL, the system always applies implicit deny. You do not have to congure it.
• For IP ACL, the system applies implicit permit for second and subsequent fragment prior to the implicit deny.
• If you congure an explicit deny, the second and subsequent fragments do not hit the implicit permit rule for fragments.
IP Fragments ACL Examples
The following examples show how you can use ACL commands with the fragment keyword to lter fragmented packets.
Example of Permitting All Packets on an Interface
Example of Denying Second and Subsequent Fragments
The following conguration permits all packets (both fragmented and non-fragmented) with destination IP 10.1.1.1. The second rule does not
get hit at all.
Dell(conf)#ip access-list extended ABC
Dell(conf-ext-nacl)#permit ip any 10.1.1.1/32
Dell(conf-ext-nacl)#
deny ip any 10.1.1.1./32 fragments
Dell(conf-ext-nacl)
To deny the second/subsequent fragments, use the same rules in a dierent order. These ACLs deny all second and subsequent fragments
with destination IP 10.1.1.1 but permit the rst fragment and non-fragmented packets with destination IP 10.1.1.1.
Dell(conf)#ip access-list extended ABC
Dell(conf-ext-nacl)#deny ip any 10.1.1.1/32 fragments
Dell(conf-ext-nacl)#permit ip any 10.1.1.1/32
Dell(conf-ext-nacl)
Layer 4 ACL Rules Examples
The following examples show the ACL commands for Layer 4 packet ltering.
When conguring ACLs with the fragments keyword, be aware of the following.
When an ACL lters packets, it looks at the fragment oset (FO) to determine whether it is a fragment.
Access Control Lists (ACLs)
115