Setup Guide

Optimizing ACL for More Number of IPv4 ACL Rules
To optimize ACL for more number of IPv4 ACL rules, follow these steps:
1 Carve the vlanaclopt CAM region.
CONFIGURATION mode
cam-acl-vlan vlanopenflow 0 vlaniscsi 0 vlanaclopt 2
2 Enable the ACL optimized feature.
CONFIGURATION mode
feature acloptimized
3 Reload the system
EXEC Privilege
reload
After the system reloads, the Dell Networking OS enables the feature.
DellEMC(conf)#feature acloptimized
Configuration change will be in effect after save and reload. ACL config containing TTL, layer3
and VRF conflicts with ACL Cam optimzation feature and these keywords would be discarded while
applying the ACL.
Dell#show feature
Feature State
------- -----
VRF disabled
UDF disabled
Aclrange disabled
Acloptimized enabled
IP Fragment Handling
The system supports a congurable option to explicitly deny IP fragmented packets, particularly second and subsequent packets.
It extends the existing ACL command syntax with the fragments keyword for all Layer 3 rules applicable to all Layer protocols (permit/
deny ip/tcp/udp/icmp).
• Both standard and extended ACLs support IP fragments.
• Second and subsequent fragments are allowed because a Layer 4 rule cannot be applied to these fragments. If the packet is to be
denied eventually, the rst fragment would be denied and hence the packet as a whole cannot be reassembled.
• Implementing the required rules uses a signicant number of CAM entries per TCP/UDP entry.
• For an IP ACL, the system always applies implicit deny. You do not have to congure it.
• For an IP ACL, the system applies implicit permit for second and subsequent fragment just prior to the implicit deny.
• If you congure an explicit deny, the second and subsequent fragments do not hit the implicit permit rule for fragments.
• Loopback interfaces do not support ACLs using the IP fragment option. If you congure an ACL with the fragments option and
apply it to a Loopback interface, the command is accepted but the ACL entries are not actually installed the oending rule in CAM.
IP Fragments ACL Examples
The following examples show how you can use ACL commands with the fragment keyword to lter fragmented packets.
Access Control Lists (ACLs)
123