S e n d d o c u m e n t a t i o n c o m m e n t s t o m d s f e e d b a c k - d o c @ c i s c o . c o m
11-44
Cisco MDS 9000 Family Command Reference
OL-18089-01, Cisco MDS NX-OS Release 4.x
Chapter 11 I Commands
ip access-list
Defaults
Denied.
Command Modes
Configuration mode.
Command History
Usage Guidelines
Using the
log-deny
option at the end of the individual ACL entries shows the ACL number and whether
the packet was permitted or denied, in addition to port-specific information. This option causes an
information logging message about the packet that matches the dropped entry (or entries).
Note
The behaviour is counterintutive compared to other cisco products and should be documented to relieve
customer satisfaction.
operator
Compares source or destination ports to the packet and has the following
options:
any
= Any destination IP
eq
= Equal source port
gt
= Greater than and including source port
lt
= Less than and including source port
range
port
= Source port range
port-value
port
port-value
Specifies the decimal number (ranging from 0 to 65535) or one of the
following names to indicate a TCP or UDP port.
The TCP port names are: dns, ftp, ftp-data, http, ntp, radius, sftp, smtp, snmp,
snmp-trap, ssh, syslog, tacacs-ds, telnet, wbem-http, wbem-https, and www.
The UDP port names are: dns, ftp, ftp-data, http, ntp, radius, sftp, smtp,
snmp, snmp-trap, ssh, syslog, tacacs-ds, telnet, tftp, wbem-http, wbem-https,
and www.
icmp-type
icmp-value
Filters ICMP packets by ICMP message type. The range is 0 to 255. The
types include: echo, echo-reply, redirect, time-exceeded, traceroute, and
unreachable.
established
Indicates an established connection for the TCP protocol. A match occurs if
the TCP datagram has the ACK, FIN, PSH, RST, SYN or URG control bits
set. The non-matching case is that of the initial TCP datagram to form a
connection.
tos
tos-value
Filters packets by the following type of service level: normal-service (0),
monetary-cost (1), reliability (2), throughput (4), and delay (8).
log-deny
Sends an information logging message to the console about the packet that is
denied entry.
Release
Modification
4.1(1b)
Added a note information for the usage section.
1.2(1)
This command was introduced.
