2-115
Catalyst 3750 Switch Command Reference
OL-8552-07
Chapter 2 Catalyst 3750 Switch Cisco IOS Commands
deny (IPv6 access-list configuration)
fragments
(Optional) Match non-initial fragmented packets where the fragment
extension header contains a non-zero fragment offset. The
fragments
keyword is an option only if the protocol is
ipv6
and the
operator
[
port-number
] arguments are not specified.
log
(Optional) Send an informational logging message to the console about the
packet that matches the entry. (The level of messages sent to the console
is controlled by the
logging console
command.)
The message includes the access list name and sequence number, whether
the packet was denied; the protocol, whether it was TCP, UDP, ICMP, or
a number; and, if appropriate, the source and destination addresses and
source and destination port numbers. The message is generated for the first
packet that matches, and then at 5-minute intervals, including the number
of packets denied in the prior 5-minute interval.
Note
Logging is not supported for port ACLs.
log-input
(Optional) Provide the same function as the
log
keyword, except that the
logging message also includes the receiving interface.
sequence
value
(Optional) Specify the sequence number for the access list statement. The
acceptable range is from 1 to 4294967295.
time-range
name
(Optional) Specify the time range that applies to the deny statement. The
name of the time range and its restrictions are specified by the
time-range
and
absolute
or
periodic
commands, respectively.
icmp-type
(Optional) Specify an ICMP message type for filtering ICMP packets.
ICMP packets can be filtered by an ICMP message type. The type is a
number from 0 to 255.
icmp-code
(Optional) Specify an ICMP message code for filtering ICMP packets.
ICMP packets that are filtered by ICMP message type can also be filtered
by the ICMP message code. The code is a number from 0 to 255.
icmp-message
(Optional) Specify an ICMP message name for filtering ICMP packets.
ICMP packets can be filtered by an ICMP message name or an ICMP
message type and code. The possible names are listed in the “Usage
Guidelines” section.
ack
(Optional) Only for the TCP protocol: Acknowledgment (ACK) bit set.
established
(Optional) Only for the TCP protocol: Means the connection has been
established. A match occurs if the TCP datagram has the ACK or RST bits
set. The nonmatching case is that of the initial TCP datagram to form a
connection.
fin
(Optional) Only for the TCP protocol: Fin bit set; no more data from
sender.
neq
{
port
|
protocol
}
(Optional) Match only packets that are not on a given port number.
psh
(Optional) Only for the TCP protocol: Push function bit set.
range
{
port
|
protocol
}
(Optional) Match only packets in the range of port numbers.
rst
(Optional) Only for the TCP protocol: Reset bit set.
syn
(Optional) Only for the TCP protocol: Synchronize bit set.
urg
(Optional) Only for the TCP protocol: Urgent pointer bit set.
