Configuration Examples For Extended Numbered Acls - Dell PowerConnect B-FCXs Configuration Manual

16
Configuring extended numbered ACLs
The 802.1p-priority-matching option inspects the 802.1p bit in the ACL that can be used with
adaptive rate limiting. Enter a value from 0 – 7. For details, refer to
ACL for adaptive rate limiting"
The dscp-marking option enables you to configure an ACL that marks matching packets with a
specified DSCP value Enter a value from 0 – 63. Refer to
(DSCP marking)"
The dscp-matching option matches on the packet's DSCP value. Enter a value from 0 – 63. This
option does not change the packet's forwarding priority through the device or mark the packet.
Refer to
The log parameter enables SNMP traps and Syslog messages for packets denied by the ACL:
•
The traffic-policy option enables the device to rate limit inbound traffic and to count the packets
and bytes per packet to which ACL permit or deny clauses are applied. For configuration
procedures and examples, refer to the chapter

Configuration examples for extended numbered ACLs

To configure an extended access list that blocks all Telnet traffic received on port 1/1 from IP host
209.157.22.26, enter the following commands.
PowerConnect(config)#access-list 101 deny tcp host 209.157.22.26 any eq telnet
log
PowerConnect(config)#access-list 101 permit ip any any
PowerConnect(config)#int eth 1/1
PowerConnect(config-if-e1000-1/1)#ip access-group 101 in
Here is another example of commands for configuring an extended ACL and applying it to an
interface. These examples show many of the syntax choices. Notice that some of the entries are
configured to generate log entries while other entries are not thus configured.
PowerConnect(config)#access-list 102 perm icmp 209.157.22.0/24 209.157.21.0/24
PowerConnect(config)#access-list 102 deny igmp host rkwong 209.157.21.0/24 log
PowerConnect(config)#access-list 102 deny igrp 209.157.21.0/24 host rkwong log
PowerConnect(config)#access-list 102 deny ip host 209.157.21.100 host
209.157.22.1 log
PowerConnect(config)#access-list 102 deny ospf any any log
PowerConnect(config)#access-list 102 permit ip any any
The first entry permits ICMP traffic from hosts in the 209.157.22.x network to hosts in the
209.157.21.x network.
The second entry denies IGMP traffic from the host device named "rkwong" to the 209.157.21.x
network.
The third entry denies IGMP traffic from the 209.157.21.x network to the host device named
"rkwong".
The fourth entry denies all IP traffic from host 209.157.21.100to host 209.157.22.1 and generates
Syslog entries for packets that are denied by this entry.
560
on page 580.
"DSCP matching" on page 581.
You can enable logging on ACLs and filters that support logging even when the ACLs and filters
are already in use. To do so, re-enter the ACL or filter command and add the log parameter to
the end of the ACL or filter. The software replaces the ACL or filter command with the new one.
The new ACL or filter, with logging enabled, takes effect immediately.
on page 765.
"Configuring Traffic Policies"
"Inspecting the 802.1p bit in the
"Using an IP ACL to mark DSCP values
on page 759.
PowerConnect B-Series FCX Configuration Guide
53-1002266-01