Users Guide

Apply ACL rules to access-group and view access-list
OS10(config)# interface ethernet 1/1/28
OS10(conf-if-eth1/1/28)# ip access-group abcd in
OS10(conf-if-eth1/1/28)# exit
OS10(config)# ip access-list acl1
OS10(conf-ipv4-acl)# permit ip host 10.1.1.1 host 100.1.1.1 count
Configuration notes
Dell EMC PowerSwitch S4200-ON Series:
● The following applications require ACL tables: VLT, iSCSI, L2 ACL, L3 v4 ACL, L3 v6 ACL, PBR v4, PBR v6, QoS L2, QoS L3,
FCoE. In ingress ACL, you can create ACL tables for two or three applications at a time.
● When a packet matches more than one ACL table, the system increments the counter for the table with the highest priority.
● In IPv6 user ACL, PBR v6 ACL, and IPv6 QoS tables—destination-port, l4-source-port, flow label, and TCP flags are not
supported.
● IP fragment supports only 2 options: non-fragment and head/non-head.
Dell EMC PowerSwitch S5200-ON Series:
When you configure QoS service-policy on an S5200-ON switch that is in a VLT setup with MAC and IP ACLs configured, an
error appears. This issue occurs because of ACL group width limitation in the S5200-ON series switches. VLT, IP, MAC, and
QoS ACLs require double-width ACL table slice. The S5200-ON series switches support only three applications that require
double-wide ACL table slice at a time. An error appears because the QoS application configuration requires a fourth ACL table
slice.
Egress ACL filters
Egress ACL filters affect the traffic leaving the network. Configuring egress ACL filters onto physical interfaces protects the
system infrastructure from a malicious and intentional attack by explicitly allowing only authorized traffic. These system-wide
ACL filters eliminate the need to apply ACL filters onto each interface.
You can use an egress ACL filter to restrict egress traffic. For example, when you isolate denial of service (DoS) attack traffic
to a specific interface, and apply an egress ACL filter to block the DoS flow from exiting the network, you protect downstream
devices.
1. Apply an egress access-list on the interface in INTERFACE mode.
ip access-group access-group-name out
2. Return to CONFIGURATION mode.
exit
3. Create the access-list in CONFIGURATION mode.
ip access-list access-list-name
4. Create the rules for the access-list in ACCESS-LIST mode.
seq 10 deny ip any any count fragment
Apply rules to ACL filter
OS10(config)# interface ethernet 1/1/29
OS10(conf-if-eth1/1/29)# ip access-group egress out
OS10(conf-if-eth1/1/29)# exit
OS10(config)# ip access-list egress
OS10(conf-ipv4-acl)# seq 10 deny ip any any count fragment
View IP ACL filter configuration
OS10# show ip access-lists out
Egress IP access-list abcd
Active on interfaces :
ethernet1/1/29
seq 10 deny ip any any fragment count (100 packets)
1446
Access Control Lists