メイン コンテンツに進む
ログアウト

Dellへようこそ

マイアカウント
  • すばやく簡単にご注文が可能
  • 注文内容の表示、配送状況をトラック
  • 会員限定の特典や割引のご利用
  • 製品リストの作成とアクセスが可能
  • 「Company Administration（会社情報の管理）」では、お使いのDell EMCのサイトや製品、製品レベルでのコンタクト先に関する情報を管理できます。
ログイン アカウントの新規作成 プレミアログイン パートナー プログラム サインイン
お問い合わせ

Dell.comカート

文書番号: 000120449

How to configure IP ACL in DELL Networking N-Series Switches

概要: This article explains how to implement IPv4 Access Control Lists (ACL) on Dell Networking N-Series Switches

この記事は自動翻訳されたものである可能性があります。品質に関するフィードバックがある場合は、このページの下部にあるフォームを使用してお知らせください。

文書の内容

手順

Table of Contents

  1. Overview

  2. Configuring Access Control Lists

  3. Verifying Access Control List Configuration


 

Overview

 

  • ACL is set of rules applied to allow or block certain traffic for security reasons. ACL's are of following types: IPv4 ACL, IPv6 ACL and MAC ACL.
  • This article exemplifies IPv4 ACL. ACL rules are grouped to form access group and are applied to the interfaces. ACL rules can be applied to ingress or egress traffic.
  • Sequence number can be assigned to every rule in the ACL at the time of configuration and are executed from the lowest to the highest sequence number.
  • If you have multiple access groups configured on an interface then assign sequence number so that the access groups are executed in order from the lowest to the highest. 


 

HOW12391_en_US__1icon As a result of creating ACLs with incorrect rule(s) it will lead to management traffic blockage.  The user will loose access to the switch. Always have an alternate access method to the switch with direct physical access using the serial console port.

 

HOW12391_en_US__2icon ACL can be applied to data ports (physical interface, port-channel and VLAN interface) and cannot be applied to out-of-band (OOB) port.


Maximum number of ACL's that can be configured on any DELL N-Series switches is 100 and maximum number if rules that can be configured per ACL is 1023

 

Configuring Access Control Lists


ACL configuration consists of following steps:


1.  Create access-group specifying ACL rules in the order to be executed using sequence number. Rules are executed from lowest to highest sequence number
2.  Assign the access-group to the interface that is supposed to filter ingress or egress traffic

 

Example:

An example is considered to better demonstrate the function of ACL's. Let us consider that incoming traffic at port gi1/0/10 subject to ACL that blocks udp traffic from network 10.10.10.0 255.255.255.0 destined to 10.10.20.0 255.255.255.0 subnet, blocks icmp packets from subnet 192.168.1.0 255.255.255.0 destined to any network, deny tcp traffic specific to telnet protocol from a particular host 172.16.1.10 subnet destined to any network and log the rule hits over console.


1.  Create access group

 

Command

Purpose

Dell# configure

Enter global configuration mode

Dell(config)# ip access-list ACL-TEST

Create access group by giving it a name. Here access group ACL-TEST is created.

ACL names can contain letters, numbers, dot, dash or underscore, but should start with a letter only, and it should be less than or equal to 31 characters long

Dell(config-ip-acl)# 10 deny udp 10.10.10.0 0.0.0.255 10.10.20.0 0.0.0.255 log

Enter the first rule make sure it has the lowest sequence number, here sequence number 10 is given. This rule denies udp traffic from the source 10.10.10.0 subnet (according to the syntax, wildcard mask 0.0.0.25 is entered) destined to 10.10.10.20. if the rule matches the action is logged on the console

Dell(config-ip-acl)# 20 deny icmp 192.168.1.0 0.0.0.255 any log

Second rule is entered with sequence number 20, denies icmp traffic form 192.168.1.0 subnet destined to any network and log if the rule hit occurs

Dell(config-ip-acl)# 30 deny tcp 172.16.1.0 0.0.0.255 any eq telnet log

Enter third rule with sequence number 30 that specifies  to deny any tcp traffic related to telnet protocol destined to any network sourced from 172.16.1.0 network and log if any rule match occurs

   
 

HOW12391_en_US__2icon If no sequence number is entered, Dell Networking OS (DNOS) automatically assigns sequence number, based on the order of the rule entered. First rule entered is assigned with lowest sequence number


2.  Apply access-group to the interface
 

Command

Purpose

Dell# configure

Enter global configuration mode

Dell(config)# interface gigabitethernet 1/0/10

Enter the interface specific configuration mode

Dell(config-if-Gi1/0/10)# ip access-group ACL-TEST in 10

Apply the access-group to the interface, such that all the ingress or incoming traffic is subjected to the rules in the access-group. If there are more than one access-groups then assign sequence number so that the access-groups can be applied in the order of lowest to highest sequence numbers. If no sequence number is specified, the access-groups are auto assigned with sequence number, fist access-group specified takes the lowest value


 

Verifying Access Control List Configuration


ACL verification commands listed below:

Dell#show ip access-lists

 

Current number of ACLs: 1  Maximum number of ACLs: 100

 

ACL Name                        Rules Interface(s)              Direction Count

---------------------------------- -------- ------------------------- ----------------- ------                                                                                                                                                      

ACL-TEST                            3        Gi1/0/10                  Inbound    12
 

Dell#show ip access-lists ACL-TEST

 

IP ACL Name: ACL-TEST


Inbound Interface(s):
Gi1/0/10


Rule Number: 10
Action......................................... deny
Match All...................................... FALSE
Protocol....................................... 17(udp)
Source IP Address.............................. 10.10.10.0
Source IP Mask................................. 0.0.0.255
Destination IP Address......................... 10.10.20.0
Destination IP Mask............................ 0.0.0.255
Log............................................ TRUE
ACL Hit Count.................................. 0

Rule Number: 20
Action......................................... deny
Match All...................................... FALSE
Protocol....................................... 1(icmp)
Source IP Address.............................. 192.168.1.0
Source IP Mask................................. 0.0.0.255
Destination IP Address......................... any
Log............................................ TRUE
ACL Hit Count.................................. 0

Rule Number: 30
Action......................................... deny
Match All...................................... FALSE
Protocol....................................... 6(tcp)
Source IP Address.............................. 172.16.1.0
Source IP Mask................................. 0.0.0.255
Destination IP Address......................... any
Destination Layer 4 Operator................... Equal To
Destination L4 Port Keyword.................... 23(telnet)
Log............................................ TRUE
ACL Hit Count.................................. 0

 

 

Dell#show running-config | begin access

 

ip access-list ACL-TEST

10 deny udp 10.10.10.0 0.0.0.255 10.10.20.0 0.0.0.255 log
20 deny icmp 192.168.1.0 0.0.0.255 any log
30 deny tcp 172.16.1.0 0.0.0.255 any eq telnet log



To implement MAC ACL, please follow the link: https://kb.dell.com/infocenter/index?page=content&id=HOW12466

文書のプロパティ

影響を受ける製品

PowerSwitch N1500 Series, PowerSwitch N2000 Series, PowerSwitch N2100 Series, PowerSwitch N3000 Series, Dell EMC PowerSwitch N3100 Series, PowerSwitch N4000 Series

最後に公開された日付

10 4月 2021

バージョン

6

文書の種類

How To

トップに戻る