Brocade Communications Systems Brocade ICX 6650 6650 User Manual

TCP Flags - edge port security

Example 

Brocade(config-ext-nACL)# permit tcp 10.1.1.1 0.0.0.255 eq 100 10.2.2.2 
0.0.0.255 eq 300 match-all +urg +ack +syn -rst

This command configures a single rule in CAM hardware. This rule will contain all of the configured 
TCP flags (urg, ack, syn, and rst).

Using TCP Flags in combination with other ACL features

The TCP Flags feature has the added capability of being combined with other ACL features. 

Example 

Brocade(config-ext-nACL)# permit tcp any any match-all +urg +ack +syn -rst 
traffic-policy test

This command configures the ACL to match incoming traffic with the TCP Flags urg, ack, and syn 
and also to apply the traffic policy (rate, limit, etc.) to the matched traffic. 

Brocade(config-ext-nACL)# permit tcp any any match-all +urg +ack +syn -rst tos 
normal

This command configures the ACL to match incoming traffic with the flags urg, ack, and syn, and 
also sets the tos bit to normal when the traffic exits the device.

NOTE

TCP Flags combines the functionality of older features such as TCP Syn Attack and TCP Establish. 
Avoid configuring these older features on a port where you have configured TCP Flags. TCP Flags can 
perform all of the functions of TCP Syn Attack and TCP Establish, and more. However, if TCP Syn 
Attack is configured on a port along with TCP Flags, TCP Syn Attack will take precedence. 

NOTE
If an ACL clause with match-any exists, and the system runs out of CAM, if the total number of TCP 
rules to TCP Flags will not fit within 1021 entries (the maximum rules allowed per device), then none 
of the TCP Flag rules will be programmed into the CAM hardware.

NOTE

If a range option and match-any TCP-flags are combined in the same ACL, the total number of rules 
will be calculated as: Total number of rules in CAM hardware = (number of rules for range)* (number 
of rules for match-any TCP-flags).