02.10.2013 Views

FTOS Configuration Guide for the C-Series - Force10 Networks

FTOS Configuration Guide for the C-Series - Force10 Networks

FTOS Configuration Guide for the C-Series - Force10 Networks

SHOW MORE
SHOW LESS

You also want an ePaper? Increase the reach of your titles

YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.

Command Syntax Command Mode Purpose<br />

{deny | permit} tcp {source mask] | any |<br />

host ip-address}} [count [byte] | log ]<br />

[order] [monitor]<br />

{deny | permit}udp {source mask | any |<br />

host ip-address}} [count [byte] | log ]<br />

[order] [monitor]<br />

When you use <strong>the</strong> ‘log’ option, CP processor logs details about <strong>the</strong> packets that match. Depending on how<br />

many packets match <strong>the</strong> ‘log’ entry and at what rate, <strong>the</strong> CP may become busy as it has to log <strong>the</strong>se<br />

packets’ details.<br />

Figure 231 illustrates an extended IP ACL in which <strong>the</strong> sequence numbers were assigned by <strong>the</strong> software.<br />

The filters were assigned sequence numbers based on <strong>the</strong> order in which <strong>the</strong>y were configured (<strong>for</strong><br />

example, <strong>the</strong> first filter was given <strong>the</strong> lowest sequence number). The show config command in <strong>the</strong> IP<br />

ACCESS LIST mode displays <strong>the</strong> two filters with <strong>the</strong> sequence numbers 5 and 10.<br />

Figure 231 Extended IP ACL<br />

To view all configured IP ACLs and <strong>the</strong> number of packets processed through <strong>the</strong> ACL, use <strong>the</strong> show ip<br />

accounting access-list command (Figure 232) in <strong>the</strong> EXEC privilege mode.<br />

Established Flag<br />

The est (established) flag is deprecated <strong>for</strong> Terascale series line cards.The flag is only available on legacy<br />

E<strong>the</strong>rscale linecards. Employ <strong>the</strong> ack and rst flags in <strong>the</strong>ir stead to achieve <strong>the</strong> same functionality.<br />

To obtain <strong>the</strong> functionality of est, use <strong>the</strong> following ACLs:<br />

• permit tcp any any rst<br />

• permit tcp any any ack<br />

CONFIG-EXT-NACL Configure a deny or permit filter to<br />

examine TCP packets.<br />

• log and monitor options are<br />

supported on E-<strong>Series</strong> only.<br />

CONFIG-EXT-NACL Configure a deny or permit filter to<br />

examine UDP packets.<br />

• log and monitor options are<br />

supported on E-<strong>Series</strong> only.<br />

<strong>Force10</strong>(config-ext-nacl)#deny tcp host 123.55.34.0 any<br />

<strong>Force10</strong>(config-ext-nacl)#permit udp 154.44.123.34 0.0.255.255 host 34.6.0.0<br />

<strong>Force10</strong>(config-ext-nacl)#show config<br />

!<br />

ip access-list extended nimule<br />

seq 5 deny tcp host 123.55.34.0 any<br />

seq 10 permit udp 154.44.0.0 0.0.255.255 host 34.6.0.0<br />

<strong>Force10</strong>(config-ext-nacl)#<br />

342 IP Access Control Lists, Prefix Lists, and Route-maps

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!