Users Guide

Example of Layer 4 ACL Rules
In this rst example, TCP packets from host 10.1.1.1 with TCP destination port equal to 24 are permitted. All others are denied.
Dell(conf)#ip access-list extended ABC
Dell(conf-ext-nacl)#permit tcp host 10.1.1.1 any eq 24
Dell(conf-ext-nacl)#
deny ip any any fragment
Dell(conf-ext-nacl)
Example of TCP Packets
In the following example, the TCP packets that are rst fragments or non-fragmented from host 10.1.1.1 with TCP destination port
equal to 24 are permitted. Additionally, all TCP non-rst fragments from host 10.1.1.1 are permitted. All other IP packets that are non-
rst fragments are denied.
Dell(conf)#ip access-list extended ABC
Dell(conf-ext-nacl)#permit tcp host 10.1.1.1 any eq 24
Dell(conf-ext-nacl)#permit tcp host 10.1.1.1 any fragment
Dell(conf-ext-nacl)#
deny ip any any fragment
Dell(conf-ext-nacl)
Example of UDP Packets
To log all the packets denied and to override the implicit deny rule and the implicit permit rule for TCP/ UDP fragments, use a
conguration similar to the following.
Dell(conf)#ip access-list extended ABC
Dell(conf-ext-nacl)#permit tcp any any fragment
Dell(conf-ext-nacl)#permit udp any any fragment
Dell(conf-ext-nacl)#deny ip any any log
Dell(conf-ext-nacl)
Congure a Standard IP ACL
To congure an ACL, use commands in IP ACCESS LIST mode and INTERFACE mode.
For a complete list of all the commands related to IP ACLs, refer to the Dell Networking OS Command Line Interface Reference
Guide. To set up extended ACLs, refer to Congure an Extended IP ACL.
A standard IP ACL uses the source IP address as its match criterion.
1. Enter IP ACCESS LIST mode by naming a standard IP access list.
CONFIGURATION mode
ip access-list standard access-listname
2. Congure a drop or forward lter.
CONFIG-STD-NACL mode
seq sequence-number {deny | permit} {source [mask] | any | host ip-address} [count
[byte]] [order] [fragments]
NOTE: When assigning sequence numbers to lters, keep in mind that you might need to insert a new lter. To prevent
reconguring multiple lters, assign sequence numbers in multiples of ve.
When you use the log keyword, the CP logs details about the packets that match. Depending on how many packets match the log
entry and at what rate, the CP may become busy as it has to log these packets’ details.
To view the rules of a particular ACL congured on a particular interface, use the show ip accounting access-list ACL-
name interface interface command in EXEC Privilege mode.
120
Access Control Lists (ACLs)