firewall fragment-drop enable

Function

The firewall fragment-drop enable command drops ACL fragmented packets.

The undo firewall fragment-drop enable command cancels the previous configuration.

firewall fragment-drop enable acl-number

undo firewall fragment-drop enable

Parameter	Description	Value
acl-number	Specifies the number of a basic ACL.	The value is an integer ranging from 2000 to 3999.

System view

2: Configuration level

By default, this function is disabled.

This command takes effect only when the rule in the associated ACL is deny.

# Drop fragmented packets that match a basic ACL with ID 2001.

<sysname> system view
[sysname] firewall fragment-drop enable 2001