deny

Use this command to create a deny access list rule entry.

Syntax

deny {any | host source-macAddr | source-macAddr source-wildcard} [any | host destination-macAddr | destination-macAddr destination-wildcard] [dei] [cos cos] [vlan vlan [vidhi]] [ethertype data] [log | log-verbose]

no deny {any | host source-macAddr | source-macAddr source-wildcard} [any | host destination-macAddr | destination-macAddr destination-wildcard] [dei] [cos cos] [vlan vlan [vidhi]] [ethertype data] [log | log-verbose]

Parameters

any	Specifies that any source MAC address and optionally any destination MAC address is applied to this deny rule entry.
host `source-macAddr`	Specifies a host source MAC address in the formats x:x:x:x:x:x or H.H.H to apply to this deny rule entry.
`source-macAddr source-wildcard`	Specifies a source MAC address and mask to apply to this deny rule entry, in the formats x:x:x:x:x:x or H.H.H.
host `destination-macAddr`	(Optional) Specifies a destination host MAC address in the formats x:x:x:x:x:x or H.H.H to apply to this deny rule entry.
`destination-macAddr destination-wildcard`	(Optional) Specifies a destination MAC address and mask to apply to this deny rule entry, in the formats x:x:x:x:x:x or H.H.H.
dei	(Optional) Specifies that the drop eligibility indicator in the VLAN tag is applied to this deny rule entry.
cos `cos`	(Optional) Specifies that the indicated class of service value is applied to this deny rule entry.
vlan `vlan`	(Optional) Specifies that the indicated VLAN identifier in the VLAN tag is applied to this deny rule entry or specifies the low end of a range of VLANs to apply to this deny rule entry.
`vidhi`	(Optional) Specifies the high end of a range of VLAN identifiers in the VLAN tag to apply to this deny rule entry
ethertype `data`	(Optional) Specifies that the indicated Ethernet II type (0x0 - 0xFFFF) to apply to this deny rule entry.
log \| log-verbose	(Optional) Enables syslog or verbose syslog messaging for an ACL rule hit.

Defaults

If any destination, a specific destination, or host destination MAC address is not specified, no destination address is applied to this deny rule entry.
If the drop eligibility indicator keyword is not specified, the VLAN tag DEI flag is not applied to this deny rule entry.
If a CoS is not specified, CoS is not applied to this deny rule entry.
If a single or range of VLANs is not specified, the VLAN identifier is not applied to this deny rule entry.
If an Ethernet II type is is not specified, the Ethernet II type is not applied to this deny rule entry.
If a logging option is not specified, ACL rule logging is not enabled for this deny rule entry.

Mode

Configuration command, L2 ACL configuration mode.

Usage

Access list logging is throttled to 1 log message per second. If there are multiple access list rules with logging enabled (log or log-verbose), and more then one frame is transmitted per second that can hit those rules, only the first frame will generate a message. Logging is sampling and does not report every time that a rule with logging enabled is hit.

Source and destination wildcard provides an inverted mask (specifies the don‘t care bits as 1s). 00:00:00:00:00:00 specifies an exact match.

The any option is short hand for 00:00:00:00:00:00 FF:FF:FF:FF:FF:FF.

The “no” version of this command removes the last (if duplicate entries exist) or the specified (if no duplicate entries exist) deny entry with the specified text.

Examples

This example enters configuration mode for the list1 L2 ACL and configures a deny entry for packets containing (verbose logging is enabled for this entry):

Any source address
A destination host with a MAC address of 00:22:89:fd:8e:f1
VLANs 11 through 13

An Ethernet II type 800

System(rw-config)->l2 access-list list1
System(rw-cfg-l2-acl)->deny any host 00:22:88:fd:8e:f1 vlan 11 13 ethertype 800 log-verbose
System(rw-cfg-l2-acl)->

This example enters configuration mode for the list2 L2 ACL and configures a deny entry for packets containing:

A source MAC address of 02:02:01:02:03:04 with a mask that ignores the first four hex characters in the address
A destination host with a MAC address of 03:13:83:fd:8e:f3
Class of Service 5
VLANs 11 through 13

An Ethernet II type 86dd

System(rw-config)->l2 access-list list2
System(rw-cfg-l2-acl)->deny 02:02:01:02:03:04 ff:ff:00:00:00:00 host 03:13:83:fd:8e:f3 cos 5 vlan 11 13 ethertype 86dd
System(rw-cfg-l2-acl)->

Published May 2016prev | next

Email this topic

Print this page Print this page

Leave feedback Feedback