02.10.2013 Views

FTOS Configuration Guide for the C-Series - Force10 Networks

FTOS Configuration Guide for the C-Series - Force10 Networks

FTOS Configuration Guide for the C-Series - Force10 Networks

SHOW MORE
SHOW LESS

Create successful ePaper yourself

Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.

To create an egress ACLs, use <strong>the</strong> ip access-group command (Figure 234) in <strong>the</strong> EXEC privilege mode.<br />

This example also shows viewing <strong>the</strong> configuration, applying rules to <strong>the</strong> newly created access group, and<br />

viewing <strong>the</strong> access list:<br />

Figure 234 Creating an Egress ACL<br />

<strong>Force10</strong>(conf)#interface gige 0/0<br />

<strong>Force10</strong>(conf-if-gige0/0)#ip access-group abcd out<br />

<strong>Force10</strong>(conf-if-gige0/0)#show config<br />

!<br />

gige<strong>the</strong>rnet 0/0<br />

no ip address<br />

ip access-group abcd out<br />

no shutdown<br />

<strong>Force10</strong>(conf-if-gige0/0)#end<br />

<strong>Force10</strong>#configure terminal<br />

<strong>Force10</strong>(conf)#ip access-list extended abcd<br />

<strong>Force10</strong>(config-ext-nacl)#permit tcp any any<br />

<strong>Force10</strong>(config-ext-nacl)#deny icmp any any<br />

<strong>Force10</strong>(config-ext-nacl)#permit 1.1.1.2<br />

<strong>Force10</strong>(config-ext-nacl)#end<br />

<strong>Force10</strong>#show ip accounting access-list<br />

!<br />

Extended Ingress IP access list abcd on gige<strong>the</strong>rnet 0/0<br />

seq 5 permit tcp any any<br />

seq 10 deny icmp any any<br />

permit 1.1.1.2<br />

Egress Layer 3 ACL Lookup <strong>for</strong> Control-plane IP Traffic<br />

The Control Plane Egress Layer 3 ACL feature enhances IP reachability debugging by implementing<br />

control-plane ACLs <strong>for</strong> CPU-generated and CPU-<strong>for</strong>warded traffic. Using permit rules with <strong>the</strong> count<br />

option, you can track on a per-flow basis whe<strong>the</strong>r CPU-generated and CPU-<strong>for</strong>warded packets were<br />

transmitted successfully.<br />

To configure this feature:<br />

1. Enable <strong>the</strong> feature using <strong>the</strong> command ip control-plane egress-filter <strong>for</strong> IPv4 traffic and <strong>the</strong><br />

command ipv6 control-plane egress-filter <strong>for</strong> IPv6 traffic.<br />

2. Create a Layer 3 ACL using permit rules with <strong>the</strong> count option to describe <strong>the</strong> desired CPU<br />

traffic.See Configuring Egress ACLs on page 346.<br />

3. Apply <strong>the</strong> ACL to <strong>the</strong> egress interface on which you want to count CPU traffic.<br />

Use <strong>the</strong> “out”<br />

keyword to specify<br />

egress.<br />

Begin applying rules<br />

to <strong>the</strong> ACL named<br />

“abcd.”<br />

View <strong>the</strong> access-list.<br />

<strong>FTOS</strong> Behavior: VRRP hellos and IGMP packets are not affected when egress ACL filtering <strong>for</strong> CPU<br />

traffic is enabled. Packets sent by <strong>the</strong> CPU with <strong>the</strong> source address as <strong>the</strong> VRRP virtual IP address<br />

have <strong>the</strong> interface MAC address instead of VRRP virtual MAC address.<br />

<strong>FTOS</strong> <strong>Configuration</strong> <strong>Guide</strong>, version 7.7.1.0 347

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!