Manualshelf

Users Guide

ManualsBrandsDell ManualsAccess PlatformsEMC Networking MX7116n
1101110211031104110511061107110811091110
Table Of Contents
● Configure a deny or permit filter to examine IP packets in IPV4-ACL mode.
{deny | permit} {source mask | any | host ip-address} [count [byte]] [fragments]
● Configure a deny or permit filter to examine TCP packets in IPV4-ACL mode.
{deny | permit} tcp {source mask] | any | host ip-address}} [count [byte]] [fragments]
● Configure a deny or permit filter to examine UDP packets in IPV4-ACL mode.
{deny | permit} udp {source mask | any | host ip-address}} [count [byte]] [fragments]
Assign sequence number to filter
OS10(config)# ip access-list acl1
OS10(conf-ipv4-acl)# seq 5 deny tcp any any capture session 1 count
View ACLs and packets processed through ACL
OS10# show ip access-lists in
Ingress IP access-list acl1
Active on interfaces :
ethernet1/1/5
seq 5 permit ip any any count (10000 packets)
Delete ACL rule
Before release 10.4.2, deleting ACL rules required a sequence number.
After release 10.4.2 or later, you can also delete ACL rules using the no form of the CLI command without using a sequence
number.
While deleting ACL rules, the following conditions apply:
● Enter the exact no form of the CLI command. Each ACL rule is an independent entity. For example, the rule, deny ip any
any is different from deny ip any any count.
For example, if you configured the following rules:
deny ip 1.1.1.1/24 2.2.2.2/24
deny ip any any
Using the no deny ip any any command deletes only the deny ip any any rule.
To delete the deny ip 1.1.1.1/24 2.2.2.2/24 rule, you must explicitly use the no deny ip 1.1.1.1/24
2.2.2.2/24 command.
NOTE: Wildcard option is not supported.
● You can no longer configure the same ACL rule multiple times using different sequence numbers. This option prevents
duplicate rules from being entered in the system and taking up memory space.
● When you upgrade from a previous release to release 10.4.2 or later, the upgrade procedure removes all duplicate ACL rules
and only one instance of an ACL rule remains in the system.
L2 and L3 ACLs
Configure both L2 and L3 ACLs on an interface in L2 mode. Rules apply if you use both L2 and L3 ACLs on an interface.
● L3 ACL filters packets and then the L2 ACL filters packets
● Egress L3 ACL filters packets
Rules apply in order:
● Ingress L3 ACL
● Ingress L2 ACL
● Egress L3 ACL
1110
Access Control Lists