Cisco Catalyst 4500 Series Configuration Manual page 231

Chapter 2 Cisco IOS Commands for the Catalyst 4500 Series Switches
deny
To deny an ARP packet based on matches against the DHCP bindings, use the deny command. To
remove the specified ACEs from the access list, use the no form of this command.
Syntax Description
request
ip
any
host sender-ip
sender-ip sender-ip-mask
mac
host sender-mac
sender-mac sender-mac-mask
response
ip
host target-ip
target-ip target-ip-mask
mac
host target-mac
target-mac target-mac-mask
log
Command Default At the end of the ARP access list, there is an implicit deny ip any mac any command.
Command Modes arp-nacl configuration mode
deny {[request] ip {any | host sender-ip | sender-ip sender-ip-mask} mac {any | host sender-mac
| sender-mac sender-mac-mask} | response ip {any | host sender-ip | sender-ip
sender-ip-mask} [{any | host target-ip | target-ip target-ip-mask}] mac {any | host sender-mac
| sender-mac sender-mac-mask} [{any | host target-mac | target-mac target-mac-mask}]} [log]
no deny {[request] ip {any | host sender-ip | sender-ip sender-ip-mask} mac {any | host
sender-mac | sender-mac sender-mac-mask} | response ip {any | host sender-ip | sender-ip
sender-ip-mask} [{any | host target-ip | target-ip target-ip-mask}] mac {any | host sender-mac
| sender-mac sender-mac-mask} [{any | host target-mac | target-mac target-mac-mask}]} [log]
Catalyst 4500 Series Switch Cisco IOS Command Reference—Release XE 3.9.xE and 15.2(5)Ex
(Optional) Requests a match for the ARP request. When request is
not specified, matching is performed against all ARP packets.
Specifies the sender IP address.
Specifies that any IP or MAC address will be accepted.
Specifies that only a specific sender IP address will be accepted.
Specifies that a specific range of sender IP addresses will be
accepted.
Specifies the sender MAC address.
Specifies that only a specific sender MAC address will be accepted.
Specifies that a specific range of sender MAC addresses will be
accepted.
Specifies a match for the ARP responses.
Specifies the IP address values for the ARP responses.
(Optional) Specifies that only a specific target IP address will be
accepted.
(Optional) Specifies that a specific range of target IP addresses will
be accepted.
Specifies the MAC address values for the ARP responses.
(Optional) Specifies that only a specific target MAC address will be
accepted.
(Optional) Specifies that a specific range of target MAC addresses
will be accepted.
(Optional) Logs a packet when it matches the access control entry
(ACE).
deny
2-193