Service Manual

seq 10 permit ip any host 1.1.1.3
seq 12 permit ip any host 1.1.1.4
Route Maps
Although route maps are similar to ACLs and prefix lists in that they consist of a series of commands that
contain a matching criterion and an action, route maps can modify parameters in matching packets.
Implementation Information
ACLs and prefix lists can only drop or forward the packet or traffic. Route maps process routes for route
redistribution. For example, a route map can be called to filter only specific routes and to add a metric.
Route maps also have an “implicit deny.” Unlike ACLs and prefix lists; however, where the packet or traffic
is dropped, in route maps, if a route does not match any of the route map conditions, the route is not
redistributed.
The implementation of route maps allows route maps with the no match or no set commands. When
there is no match command, all traffic matches the route map and the set command applies.
Logging of ACL Processes
This functionality is supported on the platform.
To assist in the administration and management of traffic that traverses the device after being validated
by the configured ACLs, you can enable the generation of logs for access control list (ACL) processes.
Although you can configure ACLs with the required permit or deny filters to provide access to the
incoming packet or disallow access to a particular user, it is also necessary to monitor and examine the
traffic that passes through the device. To evaluate network traffic that is subjected to ACLs, configure the
logs to be triggered for ACL operations. This functionality is primarily needed for network supervision and
maintenance activities of the handled subscriber traffic.
When ACL logging is configured, and a frame reaches an ACL-enabled interface and matches the ACL, a
log is generated to indicate that the ACL entry matched the packet.
When you enable ACL log messages, at times, depending on the volume of traffic, it is possible that a
large number of logs might be generated that can impact the system performance and efficiency. To
avoid an overload of ACL logs from being recorded, you can configure the rate-limiting functionality.
Specify the interval or frequency at which ACL logs must be triggered and also the threshold or limit for
the maximum number of logs to be generated. If you do not specify the frequency at which ACL logs
must be generated, a default interval of 5 minutes is used. Similarly, if you do not specify the threshold for
ACL logs, a default threshold of 10 is used, where this value refers to the number of packets that are
matched against an ACL .
A Layer 2 or Layer 3 ACL contains a set of defined rules that are saved as flow processor (FP) entries.
When you enable ACL logging for a particular ACL rule, a set of specific ACL rules translate to a set of FP
entries. You can enable logging separately for each of these FP entries, which relate to each of the ACL
entries configured in an ACL. Dell Networking OS saves a table that maps each ACL entry that matches
the ACL name on the received packet, sequence number of the rule, and the interface index in the
database. When the configured maximum threshold has exceeded, log generation stops. When the
interval at which ACL logs are configured to be recorded expires, a fresh interval timer starts and the
Access Control Lists (ACLs)
151