Home » Dell Manuals » Servers » Dell Force10 Z9000 » Manual Viewer

Dell Force10 Z9000 FTOS Command Line Reference Guide for the Z9000 System FTOS - Page 226

Extended IP ACL Commands, deny, The S4810 and Z9000 support both Ingress and Egress IP ACLs.

Add to My Manuals
Save this manual to your list of manuals

Page 226 highlights

Related Commands • The order option works across ACL groups that have been applied on an interface via the QoS policy framework. • The order option takes precedence over seq sequence-number. • If sequence-number is not configured, the rules with the same order value are ordered according to their configuration order. • If sequence-number is configured, the sequence-number is used as a tie breaker for rules with the same order. When you use the log option, the CP processor logs details about the packets that match. Depending on how many packets match the log entry and at what rate, the CP may become busy as it has to log these packets' details. NOTE: When ACL logging and byte counters are configured simultaneously, byte counters may display an incorrect value. Configure packet counters with logging instead. deny - configures a filter to drop packets. permit - configures a filter to forward packets. Extended IP ACL Commands When an ACL is created without any rule and then applied to an interface, ACL behavior reflects an implicit permit. The following commands configure extended IP ACLs, which in addition to the IP address, also examine the packet's protocol type. C-Series and S-Series platforms (except the S4810) support Ingress IP ACLs only. The S4810 and Z9000 support both Ingress and Egress IP ACLs. NOTE: Also refer to the Commands Common to all ACL Types and Common IP ACL Commands sections. deny Configure a filter that drops IP packets meeting the filter criteria. C-Series, E-Series, S-Series, Z-Series, S4810 Syntax deny {ip | ip-protocol-number} {source mask | any | host ipaddress} {destination mask | any | host ip-address} [count [byte] | log] [dscp value] [order] [monitor] [fragments] To remove this filter, you have two choices: • Use the no seq sequence-number command if you know the filter's sequence number. • Use the no deny {ip | ip-protocol-number} {source mask | any | host ip-address} {destination mask | any | host ipaddress} command. Parameters ip Enter the keyword ip to configure a generic IP access list. The keyword ip specifies that the access list denies all IP protocols. 226

Section	Page
FTOS Command Line Reference Guide for the Z9000 System FTOS 9.1.(0.0)	3
About this Guide	43
Objectives	43
Audience	43
Conventions	43
Information Icons	44
CLI Basics	45
Accessing the Command Line	45
Multiple Configuration Users	45
Object Missing	47
Obtaining Help	47
Using the Keyword no Command	48
Filtering show Commands	49
Command Modes	50
Determining Chassis Mode	56
File Management	57
boot config	57
boot host	59
boot network	59
boot system	60
boot system (S4810 and Z9000)	61
boot system gateway	62
cd	63
change bootflash-image	63
copy	64
copy (Streamline Upgrade)	66
copy running-config startup-config	67
delete	67
dir	68
download alt-boot-image	69
download alt-full-image	69
download alt-system-image	70
format (C-Series and E-Series)	70
format flash (S-Series)	71
format flash (Z9000)	72
fsck flash (S-Series and Z-Series)	72
pwd	73
rename	73
show boot system	74
show bootvar	75
show file	76
show file-systems	77
show linecard	78
show os-version	79
show running-config	80
show startup-config	84
show version	84
upgrade (C-Series version)	87
upgrade (E-Series version)	88
upgrade (S-Series management unit and Z-Series)	90
upgrade fpga-image	92
restore fpga-image	93
upgrade fpga-image	94
Control and Monitoring	97
asf-mode	97
audible cut-off	98
banner exec	98
banner login	99
banner motd	100
cam-audit linecard	101
clear alarms	102
clear command history	102
clear line	103
configure	103
debug cpu-traffic-stats	104
debug ftpserver	105
disable	105
do	106
enable	107
enable optic-info-update interval	107
enable xfp-power-updates	108
end	109
epoch	109
exec-banner	111
exec-timeout	111
exit	112
ftp-server enable	113
ftp-server topdir	114
ftp-server username	114
hostname	115
ip ftp password	116
ip ftp source-interface	116
ip ftp username	118
ip telnet server enable	118
ip telnet source-interface	119
ip tftp source-interface	120
line	121
linecard	122
linecard (4-port 40G line card)	123
module power-off	125
motd-banner	125
ping	126
power-off	129
power-on	130
reload	130
reset	131
rpm <slot> location-led	132
send	133
service timestamps	134
show alarms	135
show chassis	136
show command-history	137
show command-tree	139
show console lp	140
show cpu-traffic-stats	140
show debugging	142
show environment (C-Series and E-Series)	142
show environment (S-Series)	144
show inventory (C-Series and E-Series)	146
show inventory (S-Series and Z-Series)	148
show linecard	150
show linecard boot-information	153
show memory (C-Series and E-Series)	154
show memory (S-Series)	155
show processes cpu (C-Series and E-Series)	156
show processes cpu (S-Series)	158
show processes ipc flow-control	162
show processes memory (C-Series and E-Series)	165
show processes memory (S-Series)	168
show processes switch-utilization	171
show rpm	171
show software ifm	174
show switch links	175
show system (S-Series and Z-Series)	176
show tech-support (C-Series and E-Series)	179
show tech-support (S-Series and Z-Series)	182
ssh-peer-rpm	185
ssh-peer-stack-unit	185
telnet	186
telnet-peer-stack-unit	187
terminal length	187
terminal xml	188
traceroute	189
undebug all	191
upload trace-log	191
virtual-ip	192
write	193
802.1X	195
debug dot1x	196
dot1x auth-fail-vlan	196
dot1x auth-server	197
dot1x auth-type mab-only	197
dot1x authentication (Configuration)	198
dot1x authentication (Interface)	199
dot1x guest-vlan	199
dot1x host-mode	200
dot1x mac-auth-bypass	201
dot1x max-eap-req	201
dot1x max-supplicants	202
dot1x port-control	202
dot1x quiet-period	203
dot1x reauthentication	203
dot1x reauth-max	204
dot1x server-timeout	204
dot1x supplicant-timeout	205
dot1x tx-period	206
show dot1x cos-mapping interface	206
show dot1x interface	207
Access Control Lists (ACL)	211
Commands Common to all ACL Types	211
description	211
remark	212
show config	213
Common IP ACL Commands	214
access-class	214
clear counters ip access-group	214
ip access-group	215
ip control-plane egress-filter	216
show ip accounting access-list	216
Standard IP ACL Commands	218
deny	218
ip access-list standard	220
permit	221
resequence access-list	222
resequence prefix-list ipv4	223
seq	224
Extended IP ACL Commands	226
deny	226
deny arp	228
deny ether-type	230
deny icmp	232
deny tcp	235
deny udp	238
ip access-list extended	240
permit	241
permit arp	243
permit ether-type	245
permit icmp	247
permit tcp	248
permit udp	251
resequence access-list	254
resequence prefix-list ipv4	255
seq arp	255
seq ether-type	257
seq	259
Common MAC Access List Commands	262
clear counters mac access-group	262
mac access-group	263
show mac accounting access-list	264
Standard MAC ACL Commands	265
deny	265
mac access-list standard	266
permit	267
seq	269
Extended MAC ACL Commands	270
deny	270
mac access-list extended	272
permit	273
seq	275
IP Prefix List Commands	276
clear ip prefix-list	276
deny	277
ip prefix-list	278
permit	279
seq	279
show config	280
show ip prefix-list detail	281
show ip prefix-list summary	282
Route Map Commands	283
continue	283
description	284
match as-path	284
match community	285
match interface	286
match ip address	287
match ip next-hop	287
match ip route-source	288
match metric	289
match origin	290
match route-type	290
match tag	291
route-map	292
set as-path	293
set automatic-tag	294
set comm-list delete	294
set community	295
set level	296
set local-preference	297
set metric	298
set metric-type	298
set next-hop	299
set origin	300
set tag	301
set weight	301
show config	302
show route-map	302
AS-Path Commands	303
deny	303
ip as-path access-list	304
permit	305
show config	306
show ip as-path-access-lists	306
IP Community List Commands	307
deny	307
ip community-list	308
permit	309
show config	310
show ip community-lists	310
Bidirectional Forwarding Detection (BFD)	313
bfd all-neighbors	313
bfd disable	314
bfd enable (Configuration)	315
bfd enable (Interface)	315
bfd interval	316
bfd neighbor	317
bfd protocol-liveness	317
clear bfd counters	318
debug bfd	319
ip route bfd	320
isis bfd all-neighbors	321
neighbor bfd	322
neighbor bfd disable	323
show bfd counters	324
show bfd neighbors	325
vrrp bfd	327
Border Gateway Protocol	329
BGP IPv4 Commands	329
address-family	330
aggregate-address	330
bgp add-path	331
bgp always-compare-med	332
bgp asnotation	332
bgp bestpath as-path ignore	333
bgp bestpath as-path multipath-relax	334
bgp bestpath med confed	334
bgp bestpath med missing-as-best	335
bgp bestpath router-id ignore	335
bgp client-to-client reflection	336
bgp cluster-id	336
bgp confederation identifier	337
bgp confederation peers	338
bgp dampening	339
bgp default local-preference	340
bgp enforce-first-as	340
bgp fast-external-fallover	341
bgp four-octet-as-support	341
bgp graceful-restart	342
bgp log-neighbor-changes	343
bgp non-deterministic-med	343
bgp recursive-bgp-next-hop	344
bgp regex-eval-optz-disable	344
bgp router-id	345
bgp soft-reconfig-backup	346
capture bgp-pdu neighbor	347
capture bgp-pdu max-buffer-size	347
clear ip bgp	348
clear ip bgp dampening	349
clear ip bgp flap-statistics	350
clear ip bgp peer-group	351
debug ip bgp	351
debug ip bgp dampening	352
debug ip bgp events	353
debug ip bgp keepalives	353
debug ip bgp notifications	354
debug ip bgp soft-reconfiguration	355
debug ip bgp updates	355
default-metric	356
description	357
distance bgp	357
max-paths	358
neighbor activate	359
neighbor add-path	359
neighbor advertisement-interval	360
neighbor advertisement-start	361
neighbor allowas-in	361
neighbor default-originate	362
neighbor description	362
neighbor distribute-list	363
neighbor ebgp-multihop	364
neighbor fall-over	364
neighbor filter-list	365
neighbor graceful-restart	366
neighbor local-as	367
neighbor maximum-prefix	367
neighbor next-hop-self (C-, E-, and S-Series)	368
neighbor password	369
neighbor peer-group (assigning peers)	370
neighbor peer-group (creating group)	371
neighbor peer-group passive	372
neighbor remote-as	372
neighbor remove-private-as	373
neighbor route-map	374
neighbor route-reflector-client	375
neighbor send-community	375
neighbor shutdown	376
neighbor soft-reconfiguration inbound	377
neighbor subnet	378
neighbor timers	378
neighbor update-source	379
neighbor weight	380
network	380
network backdoor	381
redistribute	382
redistribute isis	383
redistribute ospf	384
router bgp	385
show capture bgp-pdu neighbor	386
show config	387
show ip bgp	387
show ip bgp cluster-list	389
show ip bgp community	390
show ip bgp community-list	392
show ip bgp dampened-paths	394
show ip bgp detail	394
show ip bgp extcommunity-list	396
show ip bgp filter-list	397
show ip bgp flap-statistics	398
show ip bgp inconsistent-as	400
show ip bgp neighbors	401
show ip bgp next-hop	406
show ip bgp paths	407
show ip bgp paths as-path	408
show ip bgp paths community	409
show ip bgp peer-group	410
show ip bgp regexp	412
show ip bgp summary	414
show running-config bgp	416
timers bgp	417
MBGP Commands	417
address family ipv4 multicast (MBGP)	418
aggregate-address	418
bgp dampening	419
clear ip bgp ipv4 multicast	420
clear ip bgp dampening	420
clear ip bgp flap-statistics	421
debug ip bgp dampening	422
debug ip bgp peer-group updates	422
debug ip bgp updates	423
distance bgp	423
neighbor activate	424
neighbor advertisement-interval	425
neighbor default-originate	425
neighbor distribute-list	426
neighbor filter-list	427
neighbor maximum-prefix	427
neighbor next-hop-self	428
neighbor remove-private-as	429
neighbor route-map	429
neighbor route-reflector-client	430
network	430
redistribute	431
redistribute ospf	432
show ip bgp ipv4 multicast	433
show ip bgp cluster-list	434
show ip bgp community	435
show ip bgp community-list	436
show ip bgp dampened-paths	436
show ip bgp filter-list	437
show ip bgp flap-statistics	437
show ip bgp inconsistent-as	438
show ip bgp ipv4 multicast neighbors	439
show ip bgp peer-group	442
show ip bgp summary	442
BGP Extended Communities (RFC 4360)	444
deny	444
deny regex	445
description	446
ip extcommunity-list	446
match extcommunity	447
permit	447
permit regex	448
set extcommunity rt	449
set extcommunity soo	450
show ip bgp ipv4 extcommunity-list	451
show ip bgp paths extcommunity	452
show ip extcommunity-list	452
show running-config extcommunity-list	453
IPv6 BGP Commands	454
address-family	454
aggregate-address	454
bgp always-compare-med	455
bgp bestpath as-path ignore	456
bgp bestpath med confed	456
bgp bestpath med missing-as-best	457
bgp client-to-client reflection	457
bgp cluster-id	458
bgp confederation identifier	458
bgp confederation peers	459
bgp dampening	459
bgp default local-preference	460
bgp enforce-first-as	461
bgp fast-external-fallover	461
bgp four-octet-as-support	462
bgp graceful-restart	462
bgp log-neighbor-changes	463
bgp non-deterministic-med	464
bgp recursive-bgp-next-hop	464
bgp regex-eval-optz-disable	465
bgp router-id	465
capture bgp-pdu neighbor (ipv6)	466
capture bgp-pdu max-buffer-size	466
clear ip bgp * (asterisk)	467
clear ip bgp as-number	468
clear ip bgp ipv6-address	469
clear ip bgp peer-group	470
debug ip bgp ipv6 dampening	470
clear ip bgp ipv6 flap-statistics	471
debug ip bgp	472
debug ip bgp ipv6 dampening	472
debug ip bgp events	473
debug ip bgp keepalives	474
debug ip bgp notifications	474
debug ip bgp updates	475
default-metric	476
description	476
distance bgp	477
ipv6 prefix-list	477
max-paths	478
maximum-paths	479
neighbor activate	479
neighbor advertisement-interval	480
neighbor allowas-in	480
neighbor default-originate	481
neighbor description	482
neighbor distribute-list	482
neighbor ebgp-multihop	483
neighbor fall-over	484
neighbor filter-list	484
neighbor maximum-prefix	485
neighbor X:X:X::X password	486
neighbor next-hop-self	486
neighbor peer-group (assigning peers)	487
neighbor peer-group (creating group)	488
neighbor peer-group passive	488
neighbor remote-as	489
neighbor remove-private-as	490
neighbor route-map	490
neighbor route-reflector-client	491
neighbor shutdown	492
neighbor subnet	492
neighbor timers	493
neighbor update-source	494
neighbor weight	494
network	495
network backdoor	496
redistribute	497
redistribute isis	498
redistribute ospf	499
router bgp	499
show capture bgp-pdu neighbor	500

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1,000
1,001
1,002
1,003
1,004
1,005
1,006
1,007
1,008
1,009
1,010
1,011
1,012
1,013
1,014
1,015
1,016
1,017
1,018
1,019
1,020
1,021
1,022
1,023
1,024
1,025
1,026
1,027
1,028
1,029
1,030
1,031
1,032
1,033
1,034
1,035
1,036
1,037
1,038
1,039
1,040
1,041
1,042
1,043
1,044
1,045
1,046
1,047
1,048
1,049
1,050
1,051
1,052
1,053
1,054
1,055
1,056
1,057
1,058
1,059
1,060
1,061
1,062
1,063
1,064
1,065
1,066
1,067
1,068
1,069
1,070
1,071
1,072
1,073
1,074
1,075
1,076
1,077
1,078
1,079
1,080
1,081
1,082
1,083
1,084
1,085
1,086
1,087
1,088
1,089
1,090
1,091
1,092
1,093
1,094
1,095
1,096
1,097
1,098
1,099
1,100
1,101
1,102
1,103
1,104
1,105
1,106
1,107
1,108
1,109
1,110
1,111
1,112
1,113
1,114
1,115
1,116
1,117
1,118
1,119
1,120
1,121
1,122
1,123
1,124
1,125
1,126
1,127
1,128
1,129
1,130
1,131
1,132
1,133
1,134
1,135
1,136
1,137
1,138
1,139
1,140
1,141
1,142
1,143
1,144
1,145
1,146
1,147
1,148
1,149
1,150
1,151
1,152
1,153
1,154
1,155
1,156
1,157
1,158
1,159
1,160
1,161
1,162
1,163
1,164
1,165
1,166
1,167
1,168
1,169
1,170
1,171
1,172
1,173
1,174
1,175
1,176
1,177
1,178
1,179
1,180
1,181
1,182
1,183
1,184
1,185
1,186
1,187
1,188
1,189
1,190
1,191
1,192
1,193
1,194
1,195
1,196
1,197
1,198
1,199
1,200
1,201
1,202
1,203
1,204
1,205
1,206
1,207
1,208
1,209
1,210
1,211
1,212
1,213
1,214
1,215
1,216
1,217
1,218
1,219
1,220
1,221
1,222
1,223
1,224
1,225
1,226
1,227
1,228
1,229
1,230
1,231
1,232
1,233
1,234
1,235
1,236
1,237
1,238
1,239
1,240
1,241
1,242
1,243
1,244
1,245
1,246
1,247
1,248
1,249
1,250
1,251
1,252
1,253
1,254
1,255
1,256
1,257
1,258
1,259
1,260
1,261
1,262
1,263
1,264
1,265
1,266
1,267
1,268
1,269
1,270
1,271
1,272
1,273
1,274
1,275
1,276
1,277
1,278
1,279
1,280
1,281
1,282
1,283
1,284
1,285
1,286
1,287
1,288
1,289
1,290
1,291
1,292
1,293
1,294
1,295
1,296
1,297
1,298
1,299
1,300
1,301
1,302
1,303
1,304
1,305
1,306
1,307
1,308
1,309
1,310
1,311
1,312
1,313
1,314
1,315
1,316
1,317
1,318
1,319
1,320
1,321
1,322
1,323
1,324
1,325
1,326
1,327
1,328
1,329
1,330
1,331
1,332
1,333
1,334
1,335
1,336
1,337
1,338
1,339
1,340
1,341
1,342
1,343
1,344
1,345
1,346
1,347
1,348
1,349
1,350
1,351
1,352
1,353
1,354
1,355
1,356
1,357
1,358
1,359
1,360
1,361
1,362
1,363
1,364
1,365
1,366
1,367
1,368
1,369
1,370
1,371
1,372
1,373
1,374
1,375
1,376
1,377
1,378
1,379
1,380
1,381
1,382
1,383
1,384
1,385
1,386
1,387
1,388
1,389
1,390
1,391
1,392
1,393
1,394
1,395
1,396
1,397
1,398
1,399
1,400
1,401
1,402
1,403
1,404
1,405
1,406
1,407
1,408
1,409
1,410
1,411
1,412
1,413
1,414
1,415
1,416
1,417
1,418
1,419
1,420
1,421
1,422
1,423
1,424
1,425
1,426
1,427
1,428
1,429
1,430
1,431
1,432
1,433
1,434
1,435
1,436
1,437
1,438
1,439
1,440
1,441
1,442
1,443
1,444
1,445
1,446
1,447
1,448
1,449
1,450
1,451
1,452
1,453
1,454
1,455
1,456
1,457
1,458
1,459
1,460
1,461
1,462
1,463
1,464
1,465
1,466
1,467
1,468
1,469
1,470
1,471
1,472
1,473
1,474
1,475
1,476
1,477
1,478
1,479
1,480
1,481
1,482
1,483

Match case Limit results 1 per page

•

The

order

option works across ACL groups that have been applied on an interface

via the QoS policy framework.

•

The

order

option takes precedence over

seq

sequence-number

•

sequence-number

is not configured, the rules with the same order value are

ordered according to their configuration order.

•

sequence-number

is configured, the sequence-number is used as a tie breaker

for rules with the same order.

When you use the

log

option, the CP processor logs details about the packets that match.

Depending on how many packets match the log entry and at what rate, the CP may become

busy as it has to log these packets’ details.

NOTE:

When ACL logging and byte counters are configured simultaneously, byte counters

may display an incorrect value. Configure packet counters with logging instead.

Commands

deny

– configures a filter to drop packets.

permit

– configures a filter to forward packets.

Extended IP ACL Commands

When an ACL is created without any rule and then applied to an interface, ACL behavior reflects an implicit permit.

The following commands configure extended IP ACLs, which in addition to the IP address, also examine the packet’s

protocol type.

C-Series and S-Series platforms (except the S4810) support Ingress IP ACLs only.

The S4810 and Z9000 support both Ingress and Egress IP ACLs.

NOTE:

Also refer to the

Commands Common to all ACL Types

and

Common IP ACL Commands

sections.

deny

Configure a filter that drops IP packets meeting the filter criteria.

C-Series, E-Series, S-Series, Z-Series, S4810

Syntax

deny {ip |

ip-protocol-number

} {

source mask

| any | host

ip-

address

} {

destination

mask | any | host

ip-address

} [count

[byte] | log] [dscp

value

] [order] [monitor] [fragments]

To remove this filter, you have two choices:

•

Use the

no seq

sequence-number

command if you know the filter’s sequence

number.

•

Use the

no deny {ip |

ip-protocol-number

} {

source mask

| any

| host

ip-address

} {

destination mask

| any | host

ip-

address

}

command.

Parameters

Enter the keyword

to configure a generic IP access list. The

keyword

specifies that the access list denies all IP protocols.

226