Users Guide

You can use an egress ACL filter to restrict egress traffic. For example, when you isolate denial of service (DoS) attack traffic
to a specific interface, and apply an egress ACL filter to block the DoS flow from exiting the network, you protect downstream
devices.
1. Apply an egress access-list on the interface in INTERFACE mode.
ip access-group access-group-name out
2. Return to CONFIGURATION mode.
exit
3. Create the access-list in CONFIGURATION mode.
ip access-list access-list-name
4. Create the rules for the access-list in ACCESS-LIST mode.
seq 10 deny ip any any count fragment
Apply rules to ACL filter
OS10(config)# interface ethernet 1/1/29
OS10(conf-if-eth1/1/29)# ip access-group egress out
OS10(conf-if-eth1/1/29)# exit
OS10(config)# ip access-list egress
OS10(conf-ipv4-acl)# seq 10 deny ip any any count fragment
View IP ACL filter configuration
OS10# show ip access-lists out
Egress IP access-list abcd
Active on interfaces :
ethernet1/1/29
seq 10 deny ip any any fragment count (100 packets)
Configuration notes
Dell EMC PowerSwitch S4200-ON Series:
● You can create either Layer 2 ACL or Layer 3 ACL. You cannot create both the tables at a time.
● In egress L3 IPv4 ACL, the fragment, TCP flags, and DSCP fields are not supported.
● In egress ACLs, L2 user table is utilized only for switched packets and L3 user table is utilized only for routed packets.
VTY ACLs
To limit Telnet and SSH connections to the switch, apply access lists on a virtual terminal line (VTY). See Virtual terminal line
ACLs for more information.
For VTY ACLs, there is no implicit deny rule. If none of the configured conditions match, the default behavior is to permit. If you
need to deny traffic that does not match any of the configured conditions, explicitly configure a deny statement.
SNMP ACLs
To filer SNMP requests on the switch, assign access lists to an SNMP community. Both IPv4 and IPv6 access lists are
supported to restrict IP source addresses. See Restrict SNMP access for more information.
NOTE: SNMP ACL works only when the SNMP server is reachable through the default VRF.
Access Control Lists 1241