deny

Creates a list of devices denied access to the managed network. Devices are identified by their MAC address. A single MAC address or a range of MAC addresses can be denied access. This command also sets the precedence on how deny rules are applied. Up to a thousand (1000) deny rules can be defined for every association ACL policy. Each rule has a unique sequential precedence value assigned, and are applied to packets on the basis of this precedence value. Lower the precedence of a rule, higher is its priority. This results in the rule with the lowest precedence being applied first. No two rules can have the same precedence. The default precedence is 1, so be careful to prioritize ACLs accordingly as they are added.

Supported in the following platforms:

• Access Points — AP505i, AP510i/e, AP560i/h
• Service Platforms — NX5500, NX7500, NX9500, NX9600, VX9000

Syntax

deny <STARTING-MAC> [<ENDING-MAC>|precedence]

deny <STARTING-MAC> precedence <1-1000>

deny <STARTING-MAC> <ENDING-MAC> precedence <1-1000>

Parameters

deny <STARTING-MAC> precedence <1-1000>

deny <STARTING-MAC> <ENDING-MAC> precedence <1-1000>

Usage Guidelines

Every rule has a unique sequential precedence value. You cannot add two rules with the same precedence. Rules are checked in an increasing order of precedence. That means, the rule with precedence 1 is checked first, then the rule with precedence 2 and so on.

Examples

nx9500-6C8809(config-assoc-acl-test)#deny 11-22-33-44-55-01 11-22-33-44-55-FF precedence 150

nx9500-6C8809(config-assoc-acl-test)#deny 11-22-33-44-56-01 precedence 160

nx9500-6C8809(config-assoc-acl-test)#show context
association-acl-policy test
 deny 11-22-33-44-55-01 11-22-33-44-55-FF precedence 150
 deny 11-22-33-44-56-01 precedence 160
nx9500-6C8809(config-assoc-acl-test)#

Related Commands