Cisco Catalyst 3560X-24P Command Reference Manual page 171

Chapter 2 Catalyst 3750-X and 3560-X Switch Cisco IOS Commands
any
host source-ipv6-address The source IPv6 host address for which to set deny conditions.
operator [port-number]
destination-ipv6-prefix/
prefix-length
host
destination-ipv6-address
dscp value
fragments
log
log-input
routing
OL-21522-02
An abbreviation for the IPv6 prefix ::/0.
This source-ipv6-address argument must be in the form documented in
RFC 2373 where the address is specified in hexadecimal using 16-bit
values between colons.
(Optional) Specify an operator that compares the source or destination
ports of the specified protocol. Operators are lt (less than), gt (greater
than), eq (equal), neq (not equal), and range (inclusive range).
If the operator is positioned after the source-ipv6-prefix/prefix-length
argument, it must match the source port.
If the operator is positioned after the destination-ipv6-prefix/prefix-length
argument, it must match the destination port.
The range operator requires two port numbers. All other operators require
one port number.
The optional port-number argument is a decimal number or the name of a
TCP or a UDP port. A port number is a number from 0 to 65535. TCP port
names can be used only when filtering TCP. UDP port names can be used
only when filtering UDP.
The destination IPv6 network or class of networks for which to set deny
conditions.
This argument must be in the form documented in RFC 2373 where the
address is specified in hexadecimal using 16-bit values between colons.
The destination IPv6 host address for which to set deny conditions.
This destination-ipv6-address argument must be in the form documented
in RFC 2373 where the address is specified in hexadecimal using 16-bit
values between colons.
(Optional) Match a differentiated services code point value against the
traffic class value in the Traffic Class field of each IPv6 packet header. The
acceptable range is from 0 to 63.
(Optional) Match non-initial fragmented packets where the fragment
extension header contains a non-zero fragment offset. The fragments
keyword is an option only if the protocol is ipv6 and the operator
[port-number] arguments are not specified.
(Optional) Send an informational logging message to the console about the
packet that matches the entry. (The level of messages sent to the console is
controlled by the logging console command.)
The message includes the access list name and sequence number, whether
the packet was denied; the protocol, whether it was TCP, UDP, ICMP, or a
number; and, if appropriate, the source and destination addresses and
source and destination port numbers. The message is generated for the first
packet that matches, and then at 5-minute intervals, including the number
of packets denied in the prior 5-minute interval.
Note Logging is not supported for port ACLs.
(Optional) Provide the same function as the log keyword, but the logging
message also includes the receiving interface.
(Optional) Match packets with the routing extension header.
Catalyst 3750-X and 3560-X Switch Command Reference
deny (IPv6 access-list configuration)
2-139