CCNA Complete Guide 2nd Edition.pdf - Cisco Learning Home

The Access Control List fragments Keyword
- The fragments keyword indicates that an access list entry is only applied to non-initial packet
fragments (L3). The fragment is either permitted or denied accordingly. The default behavior is
without the fragments keyword.
- The fragments keyword cannot be configured for an access list entry that contains any L4
information. Ex: access-list 101 permit tcp host 1.1.1.1 host 2.2.2.2 eq 80 fragments
is invalid.
- Without the fragments keyword (default), an access list entry that contains only L3 information
(eg: access-list 101 permit ip host 10.10.10.1 host 10.10.10.2) is matched with all
types of packets – non-fragmented packets, initial and non-initial packet fragments.
Note: The fragments keyword indicates that an access list entry will be matched with noninitial
fragments.
- Without the fragments keyword (default), an access list entry that contains L3 and L4
information (eg: access-list 101 permit tcp host 10.10.10.1 host 10.10.10.2 eq telnet)
is matched with non-fragmented packets and initial packet fragments and is either permitted or
denied accordingly.
o When a permit statement (without the fragments keyword) is matched with non-initial
packet fragments, the non-initial fragments are permitted.
o When a deny statement (without the fragments keyword) is matched with non-initial
packet fragments, the next access list entry is processed, and the fragments are not being
denied!
Summary: The deny statements (without the fragments keyword) are handled differently for
non-initial packet fragments than the permit statements (without the fragments keyword).
- Do not simply add the fragments keyword to every access list entry, as the 1st fragment (initial
fragment) will not be matched with an access list permit or deny entry that contains the
fragments keyword – the packet is compared to the next access list entry, until it is either
permitted or denied by an access list entry that does not contain the fragments keyword.
Therefore, 2 deny access list entries are needed for every deny entry. The 1st deny entry of the
pair will not include the fragments keyword to be applied for initial fragments; the 2nd deny
entry of the pair will include the fragments keyword to be applied for non-initial fragments.
- Note: Packet fragments are considered individual packets and each is counted individually as a
packet in access list accounting.
- When there are multiple deny access list entries for a particular host with different L4 ports,
only a single deny access list entry with the fragments keyword for the host is required. All
the packet fragments are handled in the same manner by the access list.
- The fragment control feature affect policy routing if the policy routing is based on the match ip
address command and the access list has entries that match L4 through L7 information.
It is possible for non-initial fragments to be matched with the access list and are policy routed,
even if the 1st fragment was not policy routed (or the reverse).
- This feature provides a better match capability between initial and non-initial fragments and
hence allows the configuration of advanced policy routing.
271
Copyright © 2008 Yap Chin Hoong
yapchinhoong@hotmail.com