Service Manual

• If you congure an explicit deny, the second and subsequent fragments do not hit the implicit permit rule for fragments.
• Loopback interfaces do not support ACLs using the IP fragment option. If you congure an ACL with the fragments option
and apply it to a Loopback interface, the command is accepted but the ACL entries are not actually installed the oending rule in
CAM.
IP Fragments ACL Examples
The following examples show how you can use ACL commands with the fragment keyword to lter fragmented packets.
Example of Permitting All Packets on an Interface
The following conguration permits all packets (both fragmented and non-fragmented) with destination IP 10.1.1.1. The second rule
does not get hit at all.
Dell(conf)#ip access-list extended ABC
Dell(conf-ext-nacl)#permit ip any 10.1.1.1/32
Dell(conf-ext-nacl)#
deny ip any 10.1.1.1/32 fragments
Dell(conf-ext-nacl)
Example of Denying Second and Subsequent Fragments
To deny the second/subsequent fragments, use the same rules in a dierent order. These ACLs deny all second and subsequent
fragments with destination IP 10.1.1.1 but permit the rst fragment and non-fragmented packets with destination IP 10.1.1.1.
Dell(conf)#ip access-list extended ABC
Dell(conf-ext-nacl)#deny ip any 10.1.1.1/32 fragments
Dell(conf-ext-nacl)#permit ip any 10.1.1.1/32
Dell(conf-ext-nacl)
Layer 4 ACL Rules Examples
The following examples show the ACL commands for Layer 4 packet ltering.
Permit an ACL line with L3 information only, and the fragments keyword is present:
If a packet’s L3 information matches the L3 information in the ACL line, the packet's FO is checked.
• If a packet's FO > 0, the packet is permitted.
• If a packet's FO = 0, the next ACL entry is processed.
Deny ACL line with L3 information only, and the fragments keyword is present:
If a packet's L3 information does match the L3 information in the ACL line, the packet's FO is checked.
• If a packet's FO > 0, the packet is denied.
• If a packet's FO = 0, the next ACL line is processed.
Example of Permitting All Packets from a Specied Host
In this rst example, TCP packets from host 10.1.1.1 with TCP destination port equal to 24 are permitted. All others are denied.
Dell(conf)#ip access-list extended ABC
Dell(conf-ext-nacl)#permit tcp host 10.1.1.1 any eq 24
Dell(conf-ext-nacl)#
deny ip any any fragment
Dell(conf-ext-nacl)
Example of Permitting Only First Fragments and Non-Fragmented Packets from a Specied Host
In the following example, the TCP packets that are rst fragments or non-fragmented from host 10.1.1.1 with TCP destination port
equal to 24 are permitted. Additionally, all TCP non-rst fragments from host 10.1.1.1 are permitted. All other IP packets that are non-
rst fragments are denied.
Dell(conf)#ip access-list extended ABC
Dell(conf-ext-nacl)#permit tcp host 10.1.1.1 any eq 24
Dell(conf-ext-nacl)#permit tcp host 10.1.1.1 any fragment
116
Access Control Lists (ACLs)