Acl Filtering For Traffic Switched Within A Virtual Routing Interface; Icmp Filtering For Extended Acls - Dell PowerConnect B-RX Configuration Manual

21

ACL filtering for traffic switched within a virtual routing interface

NOTE
The fragmented and non-fragmented parameters cannot be used together in an ACL entry.
Complete the configuration by specifying options for the ACL entry. Options you can use are
discussed in the appropriate sections for configuring ACLs in this chapter.
ACL filtering for traffic switched within a virtual routing interface
By default, a device does not filter traffic that is switched from one port to another within the same
virtual routing interface, even if an ACL is applied to the interface. You can enable the device to
filter switched traffic within a virtual routing interface. When you enable the filtering, the device
uses the ACLs applied to inbound traffic to filter traffic received by a port from another port in the
same virtual routing interface. This feature does not apply to ACLs applied to outbound traffic.
To enable filtering of traffic switched within a virtual routing interface, enter the following command
at the configuration level for the interface.
BigIron RX(config-vif-1)# ip access-group ve-traffic in
Syntax: [no] ip access-group ve-traffic in

ICMP filtering for extended ACLs

Extended ACL policies can be created to filter traffic based on its ICMP message type. You can
either enter the description of the message type or enter its type and code IDs. All packets
matching the defined ICMP message type or type number and code number are processed in
hardware.
Numbered ACLs
For example, to deny the echo message type in a numbered, extended ACL, enter commands such
as the following when configuring a numbered ACL.
BigIron RX(config)# access-list 109 deny icmp any any echo
or
BigIron RX(config)# access-list 109 deny icmp any any 8 0
Syntax: [no] access-list <num> deny | permit icmp any any [log] <icmp-type> | <type-number>
The deny | permit parameter indicates whether packets that match the policy are dropped or
forwarded.
You can either enter the name of the message type for <icmp-type> or the message's <type
number> and <code number> of the message type. Refer to
558
<code-number>
Table 99 on page 559 for valid values.
BigIron RX Series Configuration Guide
53-1001810-01