메인 콘텐츠로 이동
로그아웃

환영합니다.

내 계정
  • 빠르고 간편하게 주문
  • 주문 보기 및 배송 상태 추적
  • 제품 목록을 생성 및 액세스
로그인 계정 만들기 프리미어 로그인 Partner Program 로그인
문의처

Dell.com 카트

How to configure IP ACL in DELL Networking N-Series Switches

요약: This article explains how to implement IPv4 Access Control Lists (ACL) on Dell Networking N-Series Switches

이 문서는 다음에 적용됩니다. 이 문서는 다음에 적용되지 않습니다. 이 문서는 특정 제품과 관련이 없습니다. 모든 제품 버전이 이 문서에 나와 있는 것은 아닙니다.
기타 리소스 확인

지침

Table of Contents

  1. Overview

  2. Configuring Access Control Lists

  3. Verifying Access Control List Configuration


 

Overview

 

  • ACL is set of rules applied to allow or block certain traffic for security reasons. ACL's are of following types: IPv4 ACL, IPv6 ACL and MAC ACL.
  • This article exemplifies IPv4 ACL. ACL rules are grouped to form access group and are applied to the interfaces. ACL rules can be applied to ingress or egress traffic.
  • Sequence number can be assigned to every rule in the ACL at the time of configuration and are executed from the lowest to the highest sequence number.
  • If you have multiple access groups configured on an interface then assign sequence number so that the access groups are executed in order from the lowest to the highest. 


 

HOW12391_en_US__1icon As a result of creating ACLs with incorrect rule(s) it will lead to management traffic blockage.  The user will loose access to the switch. Always have an alternate access method to the switch with direct physical access using the serial console port.

 

HOW12391_en_US__2icon ACL can be applied to data ports (physical interface, port-channel and VLAN interface) and cannot be applied to out-of-band (OOB) port.


Maximum number of ACL's that can be configured on any DELL N-Series switches is 100 and maximum number if rules that can be configured per ACL is 1023

 

Configuring Access Control Lists


ACL configuration consists of following steps:


1.  Create access-group specifying ACL rules in the order to be executed using sequence number. Rules are executed from lowest to highest sequence number
2.  Assign the access-group to the interface that is supposed to filter ingress or egress traffic

 

Example:

An example is considered to better demonstrate the function of ACL's. Let us consider that incoming traffic at port gi1/0/10 subject to ACL that blocks udp traffic from network 10.10.10.0 255.255.255.0 destined to 10.10.20.0 255.255.255.0 subnet, blocks icmp packets from subnet 192.168.1.0 255.255.255.0 destined to any network, deny tcp traffic specific to telnet protocol from a particular host 172.16.1.10 subnet destined to any network and log the rule hits over console.


1.  Create access group

 

Command

Purpose

Dell# configure

Enter global configuration mode

Dell(config)# ip access-list ACL-TEST

Create access group by giving it a name. Here access group ACL-TEST is created.

ACL names can contain letters, numbers, dot, dash or underscore, but should start with a letter only, and it should be less than or equal to 31 characters long

Dell(config-ip-acl)# 10 deny udp 10.10.10.0 0.0.0.255 10.10.20.0 0.0.0.255 log

Enter the first rule make sure it has the lowest sequence number, here sequence number 10 is given. This rule denies udp traffic from the source 10.10.10.0 subnet (according to the syntax, wildcard mask 0.0.0.25 is entered) destined to 10.10.10.20. if the rule matches the action is logged on the console

Dell(config-ip-acl)# 20 deny icmp 192.168.1.0 0.0.0.255 any log

Second rule is entered with sequence number 20, denies icmp traffic form 192.168.1.0 subnet destined to any network and log if the rule hit occurs

Dell(config-ip-acl)# 30 deny tcp 172.16.1.0 0.0.0.255 any eq telnet log

Enter third rule with sequence number 30 that specifies  to deny any tcp traffic related to telnet protocol destined to any network sourced from 172.16.1.0 network and log if any rule match occurs

   
 

HOW12391_en_US__2icon If no sequence number is entered, Dell Networking OS (DNOS) automatically assigns sequence number, based on the order of the rule entered. First rule entered is assigned with lowest sequence number


2.  Apply access-group to the interface
 

Command

Purpose

Dell# configure

Enter global configuration mode

Dell(config)# interface gigabitethernet 1/0/10

Enter the interface specific configuration mode

Dell(config-if-Gi1/0/10)# ip access-group ACL-TEST in 10

Apply the access-group to the interface, such that all the ingress or incoming traffic is subjected to the rules in the access-group. If there are more than one access-groups then assign sequence number so that the access-groups can be applied in the order of lowest to highest sequence numbers. If no sequence number is specified, the access-groups are auto assigned with sequence number, fist access-group specified takes the lowest value


 

Verifying Access Control List Configuration


ACL verification commands listed below:

Dell#show ip access-lists

 

Current number of ACLs: 1  Maximum number of ACLs: 100

 

ACL Name                        Rules Interface(s)              Direction Count

---------------------------------- -------- ------------------------- ----------------- ------                                                                                                                                                      

ACL-TEST                            3        Gi1/0/10                  Inbound    12
 

Dell#show ip access-lists ACL-TEST

 

IP ACL Name: ACL-TEST


Inbound Interface(s):
Gi1/0/10


Rule Number: 10
Action......................................... deny
Match All...................................... FALSE
Protocol....................................... 17(udp)
Source IP Address.............................. 10.10.10.0
Source IP Mask................................. 0.0.0.255
Destination IP Address......................... 10.10.20.0
Destination IP Mask............................ 0.0.0.255
Log............................................ TRUE
ACL Hit Count.................................. 0

Rule Number: 20
Action......................................... deny
Match All...................................... FALSE
Protocol....................................... 1(icmp)
Source IP Address.............................. 192.168.1.0
Source IP Mask................................. 0.0.0.255
Destination IP Address......................... any
Log............................................ TRUE
ACL Hit Count.................................. 0

Rule Number: 30
Action......................................... deny
Match All...................................... FALSE
Protocol....................................... 6(tcp)
Source IP Address.............................. 172.16.1.0
Source IP Mask................................. 0.0.0.255
Destination IP Address......................... any
Destination Layer 4 Operator................... Equal To
Destination L4 Port Keyword.................... 23(telnet)
Log............................................ TRUE
ACL Hit Count.................................. 0

 

 

Dell#show running-config | begin access

 

ip access-list ACL-TEST

10 deny udp 10.10.10.0 0.0.0.255 10.10.20.0 0.0.0.255 log
20 deny icmp 192.168.1.0 0.0.0.255 any log
30 deny tcp 172.16.1.0 0.0.0.255 any eq telnet log



To implement MAC ACL, please follow the link: https://kb.dell.com/infocenter/index?page=content&id=HOW12466

해당 제품

PowerSwitch N1500 Series, PowerSwitch N2000 Series, PowerSwitch N2100 Series, PowerSwitch N3000 Series, Dell EMC PowerSwitch N3100 Series, PowerSwitch N4000 Series
문서 속성
문서 번호: 000120449
문서 유형: How To
마지막 수정 시간: 10 4월 2021
버전:  6
다른 Dell 사용자에게 질문에 대한 답변 찾기
지원 서비스
디바이스에 지원 서비스가 적용되는지 확인하십시오.