Extended IP ACL Commands
The following commands configure extended IP ACLs, which in addition to the IP address, also examine the
packet’s protocol type.
The C9000 supports both Ingress and Egress IP ACLs.
When an ACL is created without any rule and then applied to an interface, ACL behavior reflects an implicit
permit.
NOTE:
Commands Common to all ACL Types
sections.
deny
Configure a filter that drops IP packets meeting the filter criteria.
C9000 Series
Syntax
deny {ip |
ip-protocol-number
} {
source mask
| any | host
ip-
address
} {
destination
mask | any | host
ip-address
} [count
[bytes]] [dscp
value
] [order] [monitor] [fragments] [log [interval
minutes
] [threshold-in-msgs [count]] [monitor]
To remove this filter, you have two choices:
• Use the
no seq
sequence-number
command if you know the filter’s sequence
number.
• Use the
no deny {ip |
ip-protocol-number
} {
source mask
| any |
host
ip-address
} {
destination mask
| any | host
ip-address
}
command.
Parameters
ip
Enter the keyword
ip
to configure a generic IP access list. The
keyword
ip
specifies that the access list denies all IP protocols.
ip-protocol-
number
Enter a number from 0 to 255 to deny based on the protocol
identified in the IP protocol header.
source
Enter the IP address of the network or host from which the
packets were sent.
mask
Enter a network mask in /prefix format (/x) or A.B.C.D. The mask,
when specified in A.B.C.D format, may be either contiguous or
noncontiguous.
any
Enter the keyword
any
to specify that all routes are subject to
the filter.
Access Control Lists (ACL)
289
Summary of Contents for C9000 series
Page 1: ...Dell Networking Command Line Reference Guide for the C9000 Series Version 9 10 0 0 ...
Page 394: ...deny 14551 666 Dell Access Control Lists ACL 394 ...
Page 877: ...algorithm FIPS Cryptography 877 ...
Page 1297: ...Total 5 0 Total 5 active route s using 952 bytes IPv6 Basics 1297 ...
