Interface; Icmp Filtering For Extended Acls - Dell PowerConnect B-RX Configuration Manual

Enter the fragment parameter to allow the ACL to filter fragmented packets. Use the
non-fragmented parameter to filter non-fragmented packets.
NOTE
The fragmented and non-fragmented parameters cannot be used together in an ACL entry.
Complete the configuration by specifying options for the ACL entry. Options you can use are
discussed in the appropriate sections for configuring ACLs in this chapter.
ACL filtering for traffic switched within a virtual routing

interface

By default, a BigIron RX does not filter traffic that is switched from one port to another within the
same virtual routing interface, even if an ACL is applied to the interface. You can enable the device
to filter switched traffic within a virtual routing interface. When you enable the filtering, the device
uses the ACLs applied to inbound traffic to filter traffic received by a port from another port in the
same virtual routing interface. This feature does not apply to ACLs applied to outbound traffic.
To enable filtering of traffic switched within a virtual routing interface, enter the following command
at the configuration level for the interface.
BigIron RX(config-vif-1)# ip access-group ve-traffic in
Syntax: [no] ip access-group ve-traffic in

ICMP filtering for extended ACLs

Extended ACL policies can be created to filter traffic based on its ICMP message type. You can
either enter the description of the message type or enter its type and code IDs. All packets
matching the defined ICMP message type or type number and code number are processed in
hardware.
Numbered ACLs
For example, to deny the echo message type in a numbered, extended ACL, enter commands such
as the following when configuring a numbered ACL.
BigIron RX(config)# access-list 109 deny icmp any any echo
or
BigIron RX(config)# access-list 109 deny icmp any any 8 0
Syntax: [no] access-list <num> deny | permit icmp any any [log] <icmp-type> | <type-number>
The deny | permit parameter indicates whether packets that match the policy are dropped or
forwarded.
You can either enter the name of the message type for <icmp-type> or the message's <type
number> and <code number> of the message type. Refer to
values.
BigIron RX Series Configuration Guide
53-1002253-01
ACL filtering for traffic switched within a virtual routing interface
<code-number>
Table 103 on page 570 for valid
21
569