Skip to main content
Sign Out

Welcome to Dell

My Account
  • Place orders quickly and easily
  • View orders and track your shipping status
  • Enjoy members-only rewards and discounts
  • Create and access a list of your products
  • Manage your Dell EMC sites, products, and product-level contacts using Company Administration.
Sign In Create an Account Dell Financial Services Premier Sign In Partner Program Sign In
Contact Us

Your Dell.com Carts

Dell SmartFabric OS10 User Guide Release 10.5.3

PDF

IP ACLs

An ACL filters packets based on the:

  • IP protocol number
  • Source and destination IP address
  • Source and destination TCP port number
  • Source and destination UDP port number

For ACL, TCP, and UDP filters, match criteria on specific TCP or UDP ports. For ACL TCP filters, you can also match criteria on established TCP sessions.

When creating an ACL, the sequence of the filters is important. You can assign sequence numbers to the filters as you enter them or OS10 can assign numbers in the order you create the filters. The sequence numbers display in the show running-configuration and show ip access-lists [in | out] command output.

Ingress and egress hot-lock ACLs allow you to append or delete new rules into an existing ACL without disrupting traffic flow. Existing entries in the content-addressable memory (CAM) shuffle to accommodate the new entries. Hot-lock ACLs are enabled by default and support ACLs on all platforms.

NOTE: Hot-lock ACLs support ingress ACLs only.
NOTE: When applied on VLANs, the implicit deny rule in IP ACLs does not permit the following packets at egress:
  • IPv4 Address Resolution Protocol (ARP)
  • IPv6 Neighbor Discovery (ND)
  • IPv6 Neighbor Solicitation (NS)

To permit these packets, you must configure an explicit permit statement for the specific hosts or subnetworks with the deny rule having a lower priority to drop the rest of the packets. The deny ip any any and deny ipv6 any any rules are implicit. You do not have to configure them explicitly.

Restrictions and limitations

Consider a scenario where you create a single IPv4 ACL using the seq 10 permit ip any any count command and apply it to 150 VLANs using the range command.

When you apply sequential rules in the hardware, negligible traffic loss occurs when the implicit deny rule is executed during the time interval between these rules.

For example, when you apply the following sequential rules, negligible traffic loss occurs in the IPv4 traffic streams:

  1. Number of VLANs x number of tiles x 1 Implicit deny rule. For example, 150 x 4 x 1 = 600 rules.
  2. Number of VLANs x number of tiles x actual number of rules in the list. For example, 150 x 4 x 1 = 600 rules.

You can see this behavior in multi-tile platforms such as Z9100-ON, Z9264-ON, Z9332-ON, and so on. Because, you need to install more number of implicit deny rules before actually configuring the ACL rules. In all other Dell SmartFabric OS10 platforms, you can see this behavior if you increase the number of VLANs in the same TC.

Rate this content

Accurate
Useful
Easy to understand
Was this article helpful?
0/3000 characters
  Please provide ratings (1-5 stars).
  Please provide ratings (1-5 stars).
  Please provide ratings (1-5 stars).
  Please select whether the article was helpful or not.
  Comments cannot contain these special characters: <>()\