Setup Guide

• If a packet's FO > 0, the packet is denied.
• If a packet's FO = 0, the next ACL line is processed.
Example of Permitting All Packets from a Specied Host
In this rst example, TCP packets from host 10.1.1.1 with TCP destination port equal to 24 are permitted. All others are denied.
DellEMC(conf)#ip access-list extended ABC
DellEMC(conf-ext-nacl)#permit tcp host 10.1.1.1 any eq 24
DellEMC(conf-ext-nacl)#
deny ip any any fragment
DellEMC(conf-ext-nacl)
Example of Permitting Only First Fragments and Non-Fragmented Packets from a Specied Host
In the following example, the TCP packets that are rst fragments or non-fragmented from host 10.1.1.1 with TCP destination port equal to
24 are permitted. Additionally, all TCP non-rst fragments from host 10.1.1.1 are permitted. All other IP packets that are non-rst fragments
are denied.
DellEMC(conf)#ip access-list extended ABC
DellEMC(conf-ext-nacl)#permit tcp host 10.1.1.1 any eq 24
DellEMC(conf-ext-nacl)#permit tcp host 10.1.1.1 any fragment
DellEMC(conf-ext-nacl)#
deny ip any any fragment
DellEMC(conf-ext-nacl)
Example of Logging Denied Packets
To log all the packets denied and to override the implicit deny rule and the implicit permit rule for TCP/ UDP fragments, use a conguration
similar to the following.
DellEMC(conf)#ip access-list extended ABC
DellEMC(conf-ext-nacl)#permit tcp any any fragment
DellEMC(conf-ext-nacl)#permit udp any any fragment
DellEMC(conf-ext-nacl)#deny ip any any log
DellEMC(conf-ext-nacl)
When conguring ACLs with the fragments keyword, be aware of the following.
When an ACL lters packets, it looks at the fragment oset (FO) to determine whether it is a fragment.
• FO = 0 means it is either the rst fragment or the packet is a non-fragment.
• FO > 0 means it is dealing with the fragments of the original packet.
Congure a Standard IP ACL
To congure an ACL, use commands in IP ACCESS LIST mode and INTERFACE mode.
For a complete list of all the commands related to IP ACLs, refer to the Dell EMC Networking OS Command Line Interface Reference
Guide. To set up extended ACLs, refer to Congure an Extended IP ACL.
A standard IP ACL uses the source IP address as its match criterion.
1 Enter IP ACCESS LIST mode by naming a standard IP access list.
CONFIGURATION mode
ip access-list standard access-listname
2 Congure a drop or forward lter.
CONFIG-STD-NACL mode
seq sequence-number {deny | permit} {source [mask] | any | host ip-address} [count [byte]
[dscp] [order] [monitor [session-id]] [fragments]
NOTE
: When assigning sequence numbers to lters, keep in mind that you might need to insert a new lter. To prevent
reconguring multiple lters, assign sequence numbers in multiples of ve.
Access Control Lists (ACLs) 119