Brocade Communications Systems ServerIron ADX 12.4.00 Service Manual download pdf (Page 98)

86 ServerIron ADX NAT64 Configuration Guide

53-1002444-02

Enabling ACL filtering of fragmented packets

DRAFT: BROCADE CONFIDENTIAL

Enabling ACL filtering of fragmented packets

This section includes the following topics:

• “Filtering fragmented packets for rule-based ACLs” on page 86

• “Throttling the fragment rate” on page 86

Filtering fragmented packets for rule-based ACLs

By default, when a rule-based ACL is applied to a port, the port will use the ACL to permit or deny

the first fragment of a fragmented packet, but forward subsequent fragments of the same packet

in hardware. Generally, denying the first fragment of a packet is sufficient, since a transaction

cannot be completed without the entire packet.

NOTE

The fragmentation support described in this section applies only to rule-based ACLs.

NOTE

Enhanced fragment handling is not supported on 10 Gigabit Ethernet modules. By default, 10

Gigabit Ethernet modules also forward the first fragment instead of using the ACLs to permit or deny

the fragment.

For tighter control, you can enable CPU filtering of all packet fragments on a port. When you enable

CPU filtering, the port sends all the fragments of a fragmented packet to the CPU. The CPU then

permits or denies each fragment according to the ACL applied to the port. You can enable CPU

filtering of fragments on individual ports.

You also can configure the port to drop all packet fragments.

To enable CPU filtering of packet fragments on an individual port, enter commands such as the

following.

ServerIronADX(config)# interface ethernet 1/1

ServerIronADX(config-if-1/1)# ip access-group frag inspect

Syntax: [no] ip access-group frag inspect | deny

The inspect | deny parameter specifies whether you want fragments to be sent to the CPU or

dropped:

• inspect: This option sends all fragments to the CPU.

• deny: This option begins dropping all fragments received by the port as soon as you enter the

command. This option is especially useful if the port is receiving an unusually high rate of

fragments, which can indicate a hacker attack.

Throttling the fragment rate

By default, when you enable CPU filtering of packet fragments, all fragments are sent to the CPU.

Normally, the fragment rate in a typical network does not place enough additional load on the CPU

to adversely affect performance. However, performance can be affected if the device receives a

very high rate of fragments. For example, a misconfigured server or a hacker can affect the

device’s performance by flooding the CPU with fragments.

1 2 ... 93 94 95 96 97 98 99 100 101 102 103 ... 148 149

No comments

Brocade Communications Systems ServerIron ADX 12.4.00 Service Manual Page 98