Dell Networking S6000 Uživatelský manuál stáhnout pdf (Strana 109)

100

101

seq 5 permit tcp any any

seq 10 deny icmp any any

seq 15 permit 1.1.1.2

Configure Egress ACLs

Egress ACLs are supported on the S6000 platform.

Egress ACLs are applied to line cards and affect the traffic leaving the system. Configuring egress ACLs

onto physical interfaces protects the system infrastructure from attack — malicious and incidental — by

explicitly allowing only authorized traffic. These system-wide ACLs eliminate the need to apply ACLs onto

each interface and achieves the same results. By localizing target traffic, it is a simpler implementation.

To restrict egress traffic, use an egress ACL. For example, when a denial of service (DOS) attack traffic is

isolated to a specific interface, you can apply an egress ACL to block the flow from the exiting the box,

thus protecting downstream devices.

To create an egress ACL, use the ip access-group command in EXEC Privilege mode. The example

shows viewing the configuration, applying rules to the newly created access group, and viewing the

access list.

NOTE: VRF based ACL configurations are not supported on the egress traffic.

Example of Applying ACL Rules to Egress Traffic and Viewing ACL Configuration

To specify ingress, use the out keyword. Begin applying rules to the ACL with the ip access-list

extended

abcd command. To view the access-list, use the show command.

Dell(conf)#interface gige 0/0

Dell(conf-if-gige0/0)#

ip access-group abcd out

Dell(conf-if-gige0/0)#show config

gigethernet 0/0

no ip address

ip access-group abcd out

no shutdown

Dell(conf-if-gige0/0)#end

Dell#configure terminal

Dell(conf)#

ip access-list extended abcd

Dell(config-ext-nacl)#permit tcp any any

Dell(config-ext-nacl)#deny icmp any any

Dell(config-ext-nacl)#permit 1.1.1.2

Dell(config-ext-nacl)#end

Dell#show ip accounting access-list

Extended Ingress IP access list abcd on gigethernet 0/0

seq 5 permit tcp any any

seq 10 deny icmp any any

seq 15 permit 1.1.1.2

Dell#configure terminal

Dell(conf)#interface te 0/0

Dell(conf-if-te-0/0)#ip vrf forwarding blue

Dell(conf-if-te-0/0)#show config

interface TenGigabitEthernet 0/0

ip vrf forwarding blue

no ip address

shutdown

Access Control Lists (ACLs)

109

1 2 ... 104 105 106 107 108 109 110 111 112 113 114 ... 985 986

Komentáře k této Příručce

Žádné komentáře

Dell Networking S6000 Uživatelský manuál Strana 109

Komentáře k této Příručce

Související produkty a manuály pro Software Dell Networking S6000