Dell PowerEdge FN I/O Module Configuration Guide 9.10(0.0)

It extends the existing ACL command syntax with the fragments keyword for all Layer 3 rules applicable to all Layer protocols (permit/deny ip/tcp/udp/icmp).

• Both standard and extended ACLs support IP fragments.
• Second and subsequent fragments are allowed because a Layer 4 rule cannot be applied to these fragments. If the packet is to be denied eventually, the first fragment would be denied and hence the packet as a whole cannot be reassembled.
• Implementing the required rules uses a significant number of CAM entries per TCP/UDP entry.
• For IP ACL, the system always applies implicit deny. You do not have to configure it.
• For IP ACL, the system applies implicit permit for second and subsequent fragment prior to the implicit deny.
• If you configure an explicit deny, the second and subsequent fragments do not hit the implicit permit rule for fragments.