Dell FCX624-I Laptop User Manual


  Open as PDF
of 1494
 
1202 PowerConnect B-Series FCX Configuration Guide
53-1002266-01
TCP Flags - edge port security
32
Match-all - Indicates that incoming TCP traffic must be matched against all of the TCP flags
configured as part of the match-all ACL rule. In CAM hardware, there will be only one ACL rule
for all configured flags.
Example
PowerConnect(config-ext-nACL)#permit tcp 1.1.1.1 0.0.0.255 eq 100 2.2.2.2
0.0.0.255 eq 300 match-all +urg +ack +syn -rst
This command configures a single rule in CAM hardware. This rule will contain all of the configured
TCP flags (urg, ack, syn, and rst).
Using TCP Flags in combination with other ACL features
The TCP Flags feature has the added capability of being combined with other ACL features.
Example
PowerConnect(config-ext-nACL)#permit tcp any any match-all +urg +ack +syn -rst
traffic-policy test
This command configures the ACL to match incoming traffic with the TCP Flags urg, ack, and syn
and also to apply the traffic policy (rate, limit, etc.) to the matched traffic.
PowerConnect(config-ext-nACL)#permit tcp any any match-all +urg +ack +syn -rst tos
normal
This command configures the ACL to match incoming traffic with the flags urg, ack, and syn, and
also sets the tos bit to normal when the traffic exits the device.
NOTE
TCP Flags combines the functionality of older features such as TCP Syn Attack and TCP Establish.
Avoid configuring these older features on a port where you have configured TCP Flags. TCP Flags can
perform all of the functions of TCP Syn Attack and TCP Establish, and more. However, if TCP Syn
Attack is configured on a port along with TCP Flags, TCP Syn Attack will take precedence.
NOTE
If an ACL clause with match-any exists, and the system runs out of CAM, if the total number of TCP
rules to TCP Flags will not fit within 1021 entries (the maximum rules allowed per device), then none
of the TCP Flag rules will be programmed into the CAM hardware.
NOTE
If a range option and match-any TCP-flags are combined in the same ACL, the total number of rules
will be calculated as: Total number of rules in CAM hardware = (number of rules for range)* (number
of rules for match-any TCP-flags).