deny

Creates a list of devices denied access to the managed network. Devices are identified by their MAC address. A single MAC address or a range of MAC addresses can be denied access. This command also sets the precedence on how deny rules are applied. Up to a thousand (1000) deny rules can be defined for every association ACL policy. Each rule has a unique sequential precedence value assigned, and are applied to packets on the basis of this precedence value. Lower the precedence of a rule, higher is its priority. This results in the rule with the lowest precedence being applied first. No two rules can have the same precedence. The default precedence is 1, so be careful to prioritize ACLs accordingly as they are added.

Supported in the following platforms:

Syntax

deny <STARTING-MAC> [<ENDING-MAC>|precedence]
deny <STARTING-MAC> precedence <1-1000>
deny <STARTING-MAC> <ENDING-MAC> precedence <1-1000>

Parameters

deny <STARTING-MAC> precedence <1-1000>

deny

Adds a single device or a set of devices to the deny list

<STARTING-MAC>

To add a single device, enter its MAC address in the <STARTING-MAC> parameter.

precedence <1-1000>

Sets a precedence value for this rule. Rules are applied in an increasing order of their precedence.

  • <1-1000> – Specify a precedence value from 1 - 1000.

 
deny <STARTING-MAC> <ENDING-MAC> precedence <1-1000>

deny

Adds a single device or a set of devices to the deny list. To add a set of devices, provide the range of MAC addresses.

<STARTING-MAC>

Specify the first MAC address in the range.

<ENDING-MAC>

Specify the last MAC address in the range.

precedence <1-1000>

Sets a precedence rule. Rules are applied in an increasing order of their precedence.

  • <1-1000> – Specify a value from 1 - 1000.

Usage Guidelines

Every rule has a unique sequential precedence value. You cannot add two rules with the same precedence. Rules are checked in an increasing order of precedence. That means, the rule with precedence 1 is checked first, then the rule with precedence 2 and so on.

Examples

nx9500-6C8809(config-assoc-acl-test)#deny 11-22-33-44-55-01 11-22-33-44-55-FF precedence 150
nx9500-6C8809(config-assoc-acl-test)#deny 11-22-33-44-56-01 precedence 160
nx9500-6C8809(config-assoc-acl-test)#show context
association-acl-policy test
 deny 11-22-33-44-55-01 11-22-33-44-55-FF precedence 150
 deny 11-22-33-44-56-01 precedence 160
nx9500-6C8809(config-assoc-acl-test)#

Related Commands

no

Removes a deny rule from this Association ACL Policy
9036514-01 Rev AA