Users Guide

Determine the Order in which ACLs are Used to Classify Trac
When you link class-maps to queues using the service-queue command, Dell Networking OS matches the class-maps according
to queue priority (queue numbers closer to 0 have lower priorities).
As shown in the following example, class-map cmap2 is matched against ingress packets before cmap1.
ACLs acl1 and acl2 have overlapping rules because the address range 20.1.1.0/24 is within 20.0.0.0/8. Therefore (without the
keyword order), packets within the range 20.1.1.0/24 match positive against cmap1 and are buered in queue 7, though you intended
for these packets to match positive against cmap2 and be buered in queue 4.
In cases such as these, where class-maps with overlapping ACL rules are applied to dierent queues, use the order keyword to
specify the order in which you want to apply ACL rules. The order can range from 0 to 254. Dell Networking OS writes to the CAM
ACL rules with lower-order numbers (order numbers closer to 0) before rules with higher-order numbers so that packets are
matched as you intended. By default, all ACL rules have an order of 255.
Example of the order Keyword to Determine ACL Sequence
Dell(conf)#ip access-list standard acl1
Dell(config-std-nacl)#permit 20.0.0.0/8
Dell(config-std-nacl)#exit
Dell(conf)#ip access-list standard acl2
Dell(config-std-nacl)#permit 20.1.1.0/24 order 0
Dell(config-std-nacl)#exit
Dell(conf)#class-map match-all cmap1
Dell(conf-class-map)#match ip access-group acl1
Dell(conf-class-map)#exit
Dell(conf)#class-map match-all cmap2
Dell(conf-class-map)#match ip access-group acl2
Dell(conf-class-map)#exit
Dell(conf)#policy-map-input pmap
Dell(conf-policy-map-in)#service-queue 7 class-map cmap1
Dell(conf-policy-map-in)#service-queue 4 class-map cmap2
Dell(conf-policy-map-in)#exit
Dell(conf)#interface te 10/1
Dell(conf-if-te-10/1)#service-policy input pmap
IP Fragment Handling
Dell Networking OS supports a congurable option to explicitly deny IP fragmented packets, particularly second and subsequent
packets.
It extends the existing ACL command syntax with the fragments keyword for all Layer 3 rules applicable to all Layer protocols
(permit/deny ip/tcp/udp/icmp).
• Both standard and extended ACLs support IP fragments.
• Second and subsequent fragments are allowed because a Layer 4 rule cannot be applied to these fragments. If the packet is to
be denied eventually, the rst fragment would be denied and hence the packet as a whole cannot be reassembled.
• Implementing the required rules uses a signicant number of CAM entries per TCP/UDP entry.
• For IP ACL, Dell Networking OS always applies implicit deny. You do not have to congure it.
• For IP ACL, Dell Networking OS applies implicit permit for second and subsequent fragment just prior to the implicit deny.
• If you congure an explicit deny, the second and subsequent fragments do not hit the implicit permit rule for fragments.
• Loopback interfaces do not support ACLs using the IP fragment option. If you congure an ACL with the fragments option
and apply it to a Loopback interface, the command is accepted but the ACL entries are not actually installed the oending rule in
CAM.
IP Fragments ACL Examples
The following examples show how you can use ACL commands with the fragment keyword to lter fragmented packets.
114
Access Control Lists (ACLs)