Users Guide

ManualsBrandsDell ManualsAccess PlatformsPowerSwitch S5000

151

152

153

154

155

156

157

158

159

160

Example of Applying ACL Rules to Ingress Traffic and Viewing ACL Configuration

To specify ingress, use the in keyword. Begin applying rules to the ACL with the ip access-list

extended

abcd command. To view the access-list, use the show command.

Dell(conf)#interface tengige 0/0

Dell(conf-if-te-0/0)#ip access-group abcd in

Dell(conf-if-te-0/0)#show config

TengigEthernet 0/0

no ip address

ip access-group abcd in

no shutdown

Dell(conf-if-te-0/0)#end

Dell#configure terminal

Dell(conf)#

ip access-list extended abcd

Dell(config-ext-nacl)#permit tcp any any

Dell(config-ext-nacl)#deny icmp any any

Dell(config-ext-nacl)#permit 1.1.1.2

Dell(config-ext-nacl)#end

Dell#

show ip accounting access-list

Extended Ingress IP access list abcd on tengigEthernet 0/0

seq 5 permit tcp any any

seq 10 deny icmp any any

seq 15 permit 1.1.1.2

Configure Egress ACLs

Configuring egress ACLs onto physical interfaces protects the system infrastructure from attack — malicious

and incidental — by explicitly allowing only authorized traffic

These system-wide ACLs eliminate the need to apply ACLs onto each interface and achieves the same results.

By localizing target traffic, it is a simpler implementation.

To restrict egress traffic, use an egress ACL. For example, when a direct operating system (DOS) attack traffic

is isolated to a specific interface, you can apply an egress ACL to block the flow from the exiting the box, thus

protecting downstream devices.

To create an egress ACL, use the ip access-group command in EXEC Privilege mode. The example shows

viewing the configuration, applying rules to the newly created access group, and viewing the access list.

Example of Applying ACL Rules to Egress Traffic and Viewing ACL Configuration

To specify ingress, use the out keyword. Begin applying rules to the ACL with the ip access-list