Administrator Guide

In cases such as these, where class-maps with overlapping ACL rules are applied to dierent queues, use the order keyword to specify
the order in which you want to apply ACL rules. The order can range from 0 to 254. The system writes to the CAM ACL rules with lower-
order numbers (order numbers closer to 0) before rules with higher-order numbers so that packets are matched as you intended. By
default, all ACL rules have an order of 254.
Example of the order Keyword to Determine ACL Sequence
Dell(conf)#ip access-list standard acl1
Dell(config-std-nacl)#permit 20.0.0.0/8
Dell(config-std-nacl)#exit
Dell(conf)#ip access-list standard acl2
Dell(config-std-nacl)#
permit 20.1.1.0/24 order 0
Dell(config-std-nacl)#exit
Dell(conf)#class-map match-all cmap1
Dell(conf-class-map)#match ip access-group acl1
Dell(conf-class-map)#exit
Dell(conf)#class-map match-all cmap2
Dell(conf-class-map)#match ip access-group acl2
Dell(conf-class-map)#exit
Dell(conf)#policy-map-input pmap
Dell(conf-policy-map-in)#service-queue 7 class-map cmap1
Dell(conf-policy-map-in)#service-queue 4 class-map cmap2
Dell(conf-policy-map-in)#exit
Dell(conf)#interface tengig 1/0
Dell(conf-if-te-1/0)#service-policy input pmap
IP Fragment Handling
The system supports a congurable option to explicitly deny IP fragmented packets, particularly second and subsequent packets.
It extends the existing ACL command syntax with the fragments keyword for all Layer 3 rules applicable to all Layer protocols (permit/
deny ip/tcp/udp/icmp).
• Both standard and extended ACLs support IP fragments.
• Second and subsequent fragments are allowed because a Layer 4 rule cannot be applied to these fragments. If the packet is to be
denied eventually, the rst fragment would be denied and hence the packet as a whole cannot be reassembled.
• Implementing the required rules uses a signicant number of CAM entries per TCP/UDP entry.
• For an IP ACL, the system always applies implicit deny. You do not have to congure it.
• For an IP ACL, the system applies implicit permit for second and subsequent fragment just prior to the implicit deny.
• If you congure an explicit deny, the second and subsequent fragments do not hit the implicit permit rule for fragments.
• Loopback interfaces do not support ACLs using the IP fragment option. If you congure an ACL with the fragments option and
apply it to a Loopback interface, the command is accepted but the ACL entries are not actually installed the oending rule in CAM.
IP Fragments ACL Examples
The following examples show how you can use ACL commands with the fragment keyword to lter fragmented packets.
Example of Permitting All Packets on an Interface
The following conguration permits all packets (both fragmented and non-fragmented) with destination IP 10.1.1.1. The second rule does not
get hit at all.
Dell(conf)#ip access-list extended ABC
Dell(conf-ext-nacl)#permit ip any 10.1.1.1/32Dell(conf-ext-nacl)#deny ip any 10.1.1.1./32
fragments
Dell(conf-ext-nacl)
118
Access Control Lists (ACLs)