IP Addresses and Services Configuration Guide for Cisco 8000 Series Routers, IOS XR Releases

PDF

IP Addresses and Services Configuration Guide for Cisco 8000 Series Routers, IOS XR Releases

ACLs with fragment control

Updated: August 12, 2026

Want to summarize with AI?

Log in

This topic describes how the IP Extended Access Lists with Fragment Control feature provides granular control over non-initial IP fragments when you apply an IP extended access list.

Non-fragmented packets and the initial fragments of a packet are processed by IP extended access lists (if you apply this access list), but non-initial fragments are permitted by default.

The IP Extended Access List with Fragment Control is a configuration feature that

  • provides granular filtering control over non-initial IP fragments

  • applies Layer 3-specific access-list entries to non-initial packet fragments, and

  • utilizes an optional fragments keyword to manage how the system evaluates packet segments.

This feature adds the optional fragments keyword to these IP access list commands:

  • deny

  • permit

If you specify the fragments keyword in an access-list entry, that access-list entry applies only to non-initial fragments of packets. The fragment is either permitted or denied accordingly.

Behavior of access-list entries with and without the fragments keyword

If the access-list entry has...

Then...

No fragments keyword and all of the access-list entry information matches

For an access-list entry containing only Layer 3 information:

  • The entry is applied to non-fragmented packets, initial fragments, and non-initial fragments.

For an access-list entry containing Layer 3 and Layer 4 information:

  • The entry is applied to non-fragmented packets and initial fragments.

    • If the entry matches and is a permit statement, the packet or fragment is permitted.

    • If the entry matches and is a deny statement, the packet or fragment is denied.

  • The entry is also applied to non-initial fragments in the following manner. Because non-initial fragments contain only Layer 3 information, only the Layer 3 portion of an access-list entry can be applied. If the Layer 3 portion of the access-list entry matches:

    • If the entry is a permit statement, the non-initial fragment is permitted.

    • If the entry is a deny statement, the next access-list entry is processed.

    Note

    The deny statements are handled differently for non-initial fragments versus non-fragmented or initial fragments.

The fragments keyword and all of the access-list entry information matches

The access-list entry is applied only to non-initial fragments.

Note

If the fragments keyword is configured for an access-list entry, the Layer 4 information is ignored for the non-initial fragments.

Configuration guidelines and restrictions for ACLs with fragment control

These guidelines apply for ACLs with fragment control:

  • Do not add the fragments keyword to every access-list entry, because the first fragment of the IP packet is considered a non-fragment and is treated independently of the subsequent fragments.

  • Because an initial fragment does not match an access-list permit or deny entry that contains the fragments keyword, the packet is compared to the next access-list entry until it is either permitted or denied by an access-list entry that does not contain the fragments keyword.

  • You may need two access-list entries for every deny entry. The first deny entry of the pair does not include the fragments keyword and applies to the initial fragment. The second deny entry of the pair includes the fragments keyword and applies to the subsequent fragments.

  • If there are multiple deny access-list entries for the same host but with different Layer 4 ports, a single deny access-list entry with the fragments keyword for that host is all that has to be added. Thus, all the fragments of a packet are handled in the same manner by the access list.

  • Packet fragments of IP datagrams are considered individual packets, and each fragment counts individually as a packet in access-list accounting and access-list violation counts.

  • The fragments keyword cannot be configured for an access-list entry that contains any Layer 4 information.

  • Within the scope of ACL processing, Layer 3 information refers to fields located within the IPv4 header, for example, source, destination, and protocol. Layer 4 information refers to other data contained beyond the IPv4 header, for example, source and destination ports for TCP or UDP, flags for TCP, and type and code for ICMP.

Configure an IPv4 ACL to match on fragment type

Most denial-of-service (DoS) attacks work by flooding the network with fragmented packets. By filtering the incoming fragments of the packet in a network, you add an extra layer of protection against such attacks.

Note

IPv6 Extended Access Lists do not support the configuration of fragment types.

You can configure an IPv4 ACL to match on the fragment type and perform an appropriate action. Use the following configuration examples with the different fragment options.

Procedure

  1. Enter global configuration mode.

    Example:

    Router# configure

  2. Create an IPv4 access list to match on the various fragment types by using the ipv4 access-list acl-name command.

    Example:

    Router(config)# ipv4 access-list TEST

  3. Add access control entries (ACEs) that match on the different fragment-type flags and forward traffic to the specified next hops.

    • ACE 20 matches the dont-fragment flag (non-fragmented packet) and forwards the packet to the default (pre-configured) next hop.

    • ACE 30 matches the is-fragment flag (fragmented packet) and forwards the packet to next hop 10.10.10.1.

    • ACE 40 matches the first-fragment flag (first fragment of a fragmented packet) and forwards the packet to next hop 20.20.20.1.

    • ACE 50 matches the last-fragment flag (last fragment of a fragmented packet) and forwards the packet to next hop 30.30.30.1.

    Example:

    Router(config-ipv4-acl)# 10 permit tcp any any
Router(config-ipv4-acl)# 20 permit tcp any any fragment-type dont-fragment default
Router(config-ipv4-acl)# 30 permit udp any any fragment-type is-fragment nexthop1 ipv4 10.10.10.1
Router(config-ipv4-acl)# 40 permit ospf any any fragment-type first-fragment nexthop1 ipv4 20.20.20.1
Router(config-ipv4-acl)# 50 permit icmp any any fragment-type last-fragment nexthop1 ipv4 30.30.30.1

  4. Commit the configuration.

    Example:

    Router(config-ipv4-acl)# commit
Router(config-ipv4-acl)# exit

  5. Create another IPv4 access list to forward the first fragment of a packet and drop the last fragment.

    The ACL checks the fragment offset value ('0' for the first fragment). If the fragment is the first fragment of the packet, the packet is forwarded. If the fragment is the last fragment of the packet, it is dropped at the interface.

    Example:

    Router(config)# ipv4 access-list ACLFIRSTFRAG

  6. Add an ACE to match the first fragment and forward it to next hop 192.168.1.2, and add an ACE to match the last fragment and drop it at the interface.

    Example:

    Router(config-ipv4-acl)# 10 permit tcp any any fragment-type first-fragment nexthop1 ipv4 192.168.1.2
Router(config-ipv4-acl)# 20 deny tcp any any fragment-type last-fragment

  7. Commit the configuration.

    Example:

    Router(config-ipv4-acl)# commit

  8. Verify the configuration by using the show access-lists command.

    Example:

    Router(config-ipv4-acl)# do show access-lists
ipv4 access-list ACLFIRSTFRAG
 10 permit tcp any any fragment-type first-fragment nexthop1 ipv4 192.168.1.20
 20 deny tcp any any fragment-type last-fragment

    You have successfully configured an IPv4 ACL to match on the fragment type.

ACL matching by fragment offset

You can configure an access control list (ACL) rule to filter packets by the fragment-offset value. Depending on whether a packet matches the criteria in a permit or deny statement, the packet is either processed or dropped at the interface. Fragment-offset filtering is supported only in the ingress direction with compression mode of an ACL.

Configuration guidelines and restrictions for ACL matching by fragment offset

These restrictions apply when you configure ACL matching by fragment offset:

  • Fragment-offset filtering is supported for IPv4 packets in the default TCAM key for NC57-18DD-SE line cards, in traditional ACL mode, and not in compressed ACL mode.

  • IPv6 Extended Access Lists do not support the configuration of ACL matching by fragment-offset values.

Configure ACL matching by fragment offset

To configure fragment-offset match in an ACL, use the fragment-offset option in the permit or deny command in IPv4 or IPv6 access-list configuration mode.

Note

For fragment-offset filtering, you must attach the specific ACL to an interface with compression level 2. Otherwise, the configuration is rejected.

Procedure

  1. Configure an ACL rule to permit packets whose fragment-offset in the IPv4 header is within the range 300-400. The value 300-400 is based on the 8-byte unit, which is the same as a fragment-offset of 2400-3200 bytes.

    Example:

    ipv4 access-list fragment-offset-acl
 10 permit ipv4 any any fragment-offset range 300 400
!

  2. Verify the fragment-offset match in the ACL.

    Example:

    Router# show access-lists ipv4 fragment-offset-acl usage pfilter loc 0/4/CPU0
Wed Apr 12 19:49:54.457 UTC
Interface : Bundle-Ether70
    Input  ACL : Common-ACL : N/A  ACL : fragment-offset-acl  (comp-lvl 3)
    Output ACL : N/A
    Router# show access-lists ipv4 fragment-offset-acl hardware ing int Bundle-Ether70 loc 0/4/CPU0
Wed Apr 12 19:51:07.837 UTC
ipv4 access-list fragment-offset-acl
 10 permit ipv4 any any fragment-offset range 300 400