Users Guide

seq 120 deny icmp 20.1.6.0/24 any fragment count (0 packets)
seq 130 permit 150 any any dscp 63 count (0 packets)
To view the number of packets matching the ACL, use the count option when creating ACL entries.
● Create an ACL that uses rules with the count option, see Assign sequence number to filter.
● Apply the ACL as an inbound or outbound ACL on an interface in CONFIGURATION mode, and view the number of packets
matching the ACL.
show ip access-list {in | out}
Ingress ACL filters
To create an ingress ACL filter, use the ip access-group command in EXEC mode. To configure ingress, use the in
keyword. Apply rules to the ACL with the ip access-list acl-name command. To view the access-list, use the show
access-lists command.
1. Apply an ingress access-list on the interface in INTERFACE mode.
ip access-group access-group-name in
2. Return to CONFIGURATION mode.
exit
3. Create the access-list in CONFIGURATION mode.
ip access-list access-list-name
4. Create the rules for the access-list in ACCESS-LIST mode.
permit ip host ip-address host ip-address count
Apply ACL rules to access-group and view access-list
OS10(config)# interface ethernet 1/1/28
OS10(conf-if-eth1/1/28)# ip access-group abcd in
OS10(conf-if-eth1/1/28)# exit
OS10(config)# ip access-list acl1
OS10(conf-ipv4-acl)# permit ip host 10.1.1.1 host 100.1.1.1 count
Configuration notes
Dell EMC PowerSwitch S4200-ON Series:
● The following applications require ACL tables: VLT, iSCSI, L2 ACL, L3 v4 ACL, L3 v6 ACL, PBR v4, PBR v6, QoS L2, QoS L3,
FCoE. In ingress ACL, you can create ACL tables only for three applications at a time.
● In IPv6 ACL and PBR ACL, l4-destination-port, l4-source-port, flow label, and TCP flags are not supported.
● IP fragment supports only 2 options: non-fragment and head/non-head.
Dell EMC PowerSwitch S5200-ON Series:
When you configure QoS service-policy on an S5200-ON switch that is in a VLT setup with MAC and IP ACLs configured, an
error appears. This issue occurs because of ACL group width limitation in the S5200-ON series switches. VLT, IP, MAC, and
QoS ACLs require double-width ACL table slice. The S5200-ON series switches support only three applications that require
double-wide ACL table slice at a time. An error appears because the QoS application configuration requires a fourth ACL table
slice.
Egress ACL filters
Egress ACL filters affect the traffic leaving the network. Configuring egress ACL filters onto physical interfaces protects the
system infrastructure from a malicious and intentional attack by explicitly allowing only authorized traffic. These system-wide
ACL filters eliminate the need to apply ACL filters onto each interface.
1240
Access Control Lists