Table of Contents
Advertisement
ACL Commands
78-20269-01 Command Line Interface Reference Guide
User Guidelines
After an ACE is added to an access control list, an implicit deny any condition
exists at the end of the list. That is, if there are no matches, the packets are denied.
However, before the first ACE is added, the list permits all packets up to
#ASIC-specific ranges for TCP and up to #ASIC-specific ranges for UDP. If a range
of ports is used for source port in an ACE, it is not counted again, if it is also used
for a source port in another ACE. If a range of ports is used for the destination port
in an ACE, it is not counted again if it is also used for destination port in another
ACE.
If a range of ports is used for source port it is counted again if it is also used for
destination port.
Example
console(config)# ip access-list extended server
console(config-ip-al)# permit ip 176.212.0.0 00.255.255
40.3
deny ( IP )
Use the deny IP Access-list Configuration mode command to set deny conditions
for IPv4 access list. Deny conditions are also known as access control entries
(ACEs).
Syntax
protocol {any | source source-wildcard} {any | destination
deny
destination-wildcard} [dscp number | precedence number]
deny
icmp {any | source source-wildcard} {any | destination destination-wildcard}
[any | icmp-type] [any | icmp-code]] [dscp number | precedence number]
igmp {any | source source-wildcard} {any | destination
deny
destination-wildcard}[igmp-type] [dscp number | precedence number]
{any | source source-wildcard} {any| s ource-port/port-range}{any |
deny tcp
destination destination-wildcard} {any| d estination-port/port-range } [dscp number |
precedence number] [match-all list-of-flags]
{any | source source-wildcard} {any| s ource-port/port-range} {any |
deny udp
destination destination-wildcard} {any| d estination-port/port-range} [dscp number |
precedence number]
40
536
Advertisement
Table of Contents
