2-104
Cisco Catalyst Blade Switch 3130 and 3032 for Dell Command Reference
OL-13271-03
Chapter 2 Cisco Catalyst Blade Switch 3130 and 3032 for Dell Cisco IOS Commands
deny (IPv6 access-list configuration)
host
source-ipv6-address
The source IPv6 host address for which to set deny conditions.
This
source-ipv6-address
argument must be in the form documented in
RFC 2373 where the address is specified in hexadecimal using 16-bit
values between colons.
operator
[
port-number
]
(Optional) Specify an operator that compares the source or destination
ports of the specified protocol. Operators are
lt
(less than),
gt
(greater
than),
eq
(equal),
neq
(not equal), and
range
(inclusive range).
If the operator is positioned after the
source-ipv6-prefix
/
prefix-length
argument, it must match the source port.
If the operator is positioned after the
destination-ipv6-prefix
/
prefix-length
argument, it must match the destination port.
The
range
operator requires two port numbers. All other operators require
one port number.
The optional
port-number
argument is a decimal number or the name of a
TCP or a UDP port. A port number is a number from 0 to 65535. TCP port
names can be used only when filtering TCP. UDP port names can be used
only when filtering UDP.
destination-ipv6-prefix
/
prefix-length
The destination IPv6 network or class of networks for which to set deny
conditions.
This argument must be in the form documented in RFC 2373 where the
address is specified in hexadecimal using 16-bit values between colons.
host
destination-ipv6-address
The destination IPv6 host address for which to set deny conditions.
This
destination-ipv6-address
argument must be in the form documented
in RFC 2373 where the address is specified in hexadecimal using 16-bit
values between colons.
dscp
value
(Optional) Match a differentiated services code point value against the
traffic class value in the Traffic Class field of each IPv6 packet header. The
acceptable range is from 0 to 63.
fragments
(Optional) Match non-initial fragmented packets where the fragment
extension header contains a non-zero fragment offset. The
fragments
keyword is an option only if the protocol is
ipv6
and the
operator
[
port-number
] arguments are not specified.
log
(Optional) Send an informational logging message to the console about the
packet that matches the entry. (The level of messages sent to the console
is controlled by the
logging console
command.)
The message includes the access list name and sequence number, whether
the packet was denied; the protocol, whether it was TCP, UDP, ICMP, or
a number; and, if appropriate, the source and destination addresses and
source and destination port numbers. The message is generated for the first
packet that matches, and then at 5-minute intervals, including the number
of packets denied in the prior 5-minute interval.
Note
Logging is not supported for port ACLs.
log-input
(Optional) Provide the same function as the
log
keyword, but the logging
message also includes the receiving interface.
routing
(Optional) Match packets with the routing extension header.
