Home » HP Manuals » Storage Devices » HP Cisco MDS 9120 » Manual Viewer

HP Cisco MDS 9120 Cisco Nexus 5000 Series Command Reference Release 4.0(1a)N2( - Page 354

Command Modes, Command History, Usage Guidelines, Release, Modification, Source and Destination

Add to My Manuals
Save this manual to your list of manuals

Page 354 highlights

deny (IPv4) Chapter 6 Security Commands Send comments to [email protected] If you do not specify a sequence number, the switch assigns the rule a sequence number that is 10 greater than the last rule in the ACL. Command Modes IPv4 ACL configuration Command History Release 4.0(0)N1(1a) Modification This command was introduced. Usage Guidelines When the switch applies an IPv4 ACL to a packet, it evaluates the packet with every rule in the ACL. The switch enforces the first rule whose conditions are satisfied by the packet. When the conditions of more than one rule are satisfied, the switch enforces the rule with the lowest sequence number. Source and Destination You can specify the source and destination arguments in one of several ways. In each rule, the method that you use to specify one of these arguments does not affect how you specify the other argument. When you configure a rule, use the following methods to specify the source and destination arguments: • IP address group object-You can use an IPv4 address group object to specify a source or destination argument. Use the object-group ip address command to create and change IPv4 address group objects. The syntax is as follows: addrgroup address-group-name The following example shows how to use an IPv4 address object group named lab-gateway-svrs to specify the destination argument: switch(config-acl)# deny ip any addrgroup lab-gateway-svrs • Address and network wildcard-You can use an IPv4 address followed by a network wildcard to specify a host or a network as a source or destination. The syntax is as follows: IPv4-address network-wildcard The following example shows how to specify the source argument with the IPv4 address and network wildcard for the 192.168.67.0 subnet: switch(config-acl)# deny tcp 192.168.67.0 0.0.0.255 any • Address and variable-length subnet mask-You can use an IPv4 address followed by a variable-length subnet mask (VLSM) to specify a host or a network as a source or destination. The syntax is as follows: IPv4-address/prefix-len The following example shows how to specify the source argument with the IPv4 address and VLSM for the 192.168.67.0 subnet: switch(config-acl)# deny udp 192.168.67.0/24 any • Host address-You can use the host keyword and an IPv4 address to specify a host as a source or destination. The syntax is as follows: host IPv4-address This syntax is equivalent to IPv4-address/32 and IPv4-address 0.0.0.0. 6-20 Cisco Nexus 5000 Series Command Reference OL-16599-01

Section	Page
Cisco Nexus 5000 Series Command Reference	1
Contents	3
Preface	19
Audience	19
Organization	19
Document Conventions	20
Obtaining Documentation and Submitting a Service Request	21
Related Documentation	21
Basic System Commands	23
banner motd	24
boot	25
cd	27
clear cli history	28
clear cores	29
clear debug-logfile	30
clear install failure-reason	31
clear license	32
clear user	33
cli var name	34
clock set	36
clock summer-time	37
clock timezone	39
configure session	40
configure terminal	41
copy	42
copy running-config startup-config	46
databits	47
debug logfile	48
debug logging	49
delete	50
dir	52
echo	54
end	55
exec-timeout	56
exit (EXEC)	58
exit (global)	59
feature fcoe	60
feature interface-vlan	61
feature lacp	62
feature private-vlan	63
feature tacacs+	64
feature udld	65
find	66
format	67
gunzip	68
gzip	69
hostname	70
install all	71
install license	74
line console	75
line vty	76
modem in	77
modem init-string	78
modem set-string user-input	80
move	81
parity	83
ping	84
ping6	86
reload	88
rmdir	89
run-script	90
save	91
send	92
setup	93
session-limit	94
show banner motd	95
show boot	96
show cli alias	97
show cli history	98
show cli variables	99
show clock	100
show copyright	101
show debug logfile	102
show environment	103
show file	104
show hardware internal	105
show hostname	106
show incompatibility system	107
show install all	108
show inventory	109
show license	110
show license host-id	111
show license usage	112
show line	114
show module	115
show processes	116
show processes cpu	117
show processes log	118
show processes memory	119
show running-config	120
show running-config diff	121
show sprom	123
show startup-config	125
show switchname	126
show system cores	127
show system reset-reason	128
show system uptime	129
show tech-support	130
show terminal	131
show version	132
sleep	133
speed	134
stopbits	135
system cores	136
system startup-config unlock	137
switchname	138
tail	139
terminal length	140
terminal session-timeout	141
terminal terminal-type	142
terminal width	143
traceroute	144
traceroute6	145
update license	146
write erase	147
Ethernet Commands	149
bandwidth (interface)	150
cdp	152
cdp enable	154
channel-group (Ethernet)	155
clear mac access-list counters	158
clear mac dynamic	159
clear mac-address-table dynamic	160
clear spanning-tree counters	162
clear spanning-tree detected-protocol	163
delay (interface)	164
description (interface)	165
instance vlan	166
interface ethernet	168
interface port-channel	169
ip igmp snooping (EXEC)	171
ip igmp snooping (VLAN)	172
lacp port-priority	174
lacp system-priority	175
link debounce	176
mac-address-table aging-time	177
mac-address-table notification	179
mac-address-table static	180
monitor session	182
name (VLAN configuration)	183
name (MST configuration)	184
port-channel load-balance ethernet	185
private-vlan	187
private-vlan association	189
private-vlan synchronize	191
revision	192
shutdown (VLAN configuration)	193
spanning-tree bpdufilter	195
spanning-tree bpduguard	197
spanning-tree cost	199
spanning-tree guard	201
spanning-tree link-type	202
spanning-tree loopguard default	203
spanning-tree mode	204
spanning-tree mst configuration	205
spanning-tree mst cost	207
spanning-tree mst forward-time	209
spanning-tree mst hello-time	210
spanning-tree mst max-age	211
spanning-tree mst max-hops	212
spanning-tree mst port-priority	213
spanning-tree mst priority	214
spanning-tree mst root	215
spanning-tree mst simulate pvst	217
spanning-tree mst simulate pvst global	219
spanning-tree pathcost method	221
spanning-tree port type edge	222
spanning-tree port type edge bpdufilter default	224
spanning-tree port type edge bpduguard default	226
spanning-tree port type edge default	228
spanning-tree port type network	230
spanning-tree port type network default	232
spanning-tree port-priority	234
spanning-tree vlan	235
speed (Ethernet)	237
state	238
svi enable	239
switchport access vlan	240
switchport block	241
switchport mode private-vlan host	242
switchport mode private-vlan promiscuous	243
switchport private-vlan host-association	244
switchport private-vlan mapping	246
udld (configuration mode)	248
udld (Ethernet)	250
vlan (EXEC mode)	251
vrf context	253
Ethernet Show Commands	255
show interface mac-address	256
show interface private-vlan mapping	257
show interface switchport	258
show interface vlan	259
show ip igmp snooping	261
show lacp	262
show mac-address-table aging-time	263
show mac-address-table count	264
show mac-address-table notification	265
show mac-address-table	266
show monitor session	268
show running-config	269
show running-config spanning-tree	270
show running-config vlan	271
show spanning-tree	272
show spanning-tree active	275
show spanning-tree bridge	276
show spanning-tree brief	278
show spanning-tree detail	279
show spanning-tree interface	280
show spanning-tree mst	282
show spanning-tree root	284
show spanning-tree summary	286
show spanning-tree vlan	287
show startup-config	290
show vlan	291
show vlan id	293
show vlan private-vlan	294
Fabric Extender Commands	295
attach fex	296
beacon	297
description (fex)	298
fex	299
fex associate	300
fex pinning redistribute	301
logging fex	302
pinning max-links	303
serial	305
show diagnostic result fex	307
show environment fex	308
show fex	309
show fex transceiver	310
show fex version	311
show interface fex-fabric	312
show interface fex-intf	313
show interface transceiver fex-fabric	314
switchport mode fex-fabric	315
Quality of Service Commands	317
class-map	318
fcoe mode	319
flowcontrol	320
match cos	321
policy-map	322
priority-flow-control	324
service-policy	325
show class-map	327
show policy-map	328
show system qos	329
show interface priority-flow-control	330
show policy-map interface	331
system jumbomtu	332
system qos	333
untagged cos	334
Security Commands	335
aaa accounting default	336
aaa authentication login console	337
aaa authentication login default	339
aaa authentication login error-enable	341
aaa authentication login mschap enable	342
aaa group server radius	343
action	344
clear access-list counters	345
clear accounting log	346
deadtime	347
deny (IPv4)	349
deny (IPv6)	359
deny (MAC)	368
description (user role)	371
feature	372
interface policy deny	373
ip access-list	374
ip port access-group	376
ipv6 access-list	378
ipv6 port traffic-filter	379
mac access-list	381
mac port access-group	383
match	385
permit (IPv4)	387
permit (IPv6)	397
permit (MAC)	406
permit interface	409
permit vlan	411
permit vrf	413
radius-server deadtime	414
radius-server directed-request	415
radius-server host	416
radius-server key	418
radius-server retransmit	419
radius-server timeout	420
remark	421
resequence	423
role feature-group name	425
role name	426
rule	427
server	429
show aaa accounting	431
show aaa authentication	432
show aaa groups	433
show access-lists	434
show accounting log	435
show ip access-lists	436
show ipv6 access-lists	437
show mac access-lists	439
show radius-server	440
show role	442
show role feature	443
show role feature-group	444
show running-config aaa	445
show running-config radius	446
show running-config security	447
show ssh key	448
show ssh server	449
show startup-config aaa	450
show startup-config radius	451
show startup-config security	452
show tacacs-server	453
show telnet server	455
show user-account	456
show users	457
show vlan access-list	458
show vlan access-map	459
show vlan filter	460
ssh	461
ssh6	462
ssh key	463
ssh server enable	465
storm-control level	466
tacacs-server deadtime	468
tacacs-server directed-request	469
tacacs-server host	470
tacacs-server key	472
tacacs-server timeout	473
telnet	474
telnet server enable	475
telnet6	476
use-vrf	477
username	479
vlan access-map	481
vlan filter	482
vlan policy deny	484
vrf policy deny	485
System Management Commands	487
clear logging nvram	488
clear logging onboard	489
clear logging session	490
clear ntp session	491
clear ntp statistics	492
logging console	493
logging event	494
logging event port	495
logging level	496
logging logfile	498
logging module	500
logging monitor	501
logging server	502
logging timestamp	504
ntp	505
ntp abort	506
ntp commit	507
ntp distribute	508
ntp sync-retry	509
show logging console	510
show logging info	511
show logging last	512
show logging level	513
show logging logfile	514
show logging module	515
show logging monitor	516
show logging nvram	517
show logging onboard	518
show logging server	523
show logging session status	524
show logging status	525
show logging timestamp	526
show ntp peer-status	527
show ntp peers	528
show ntp statistics	529
show ntp timestamp-status	530
System Message Logging Facilities	531
Fibre Channel Commands	535
cfs distribute	536
cfs ipv4 distribute	537
cfs ipv4 mcast-address	539
cfs ipv6 distribute	541
cfs ipv6 mcast-address	543
cfs region	545
cfs staggered-merge	546
clear device-alias	547
clear fcdomain	548
clear fcflow stats	549
clear fcns statistics	550
clear fcsm log	551
clear fcs statistics	552
clear fctimer session	553
clear fspf counters	554
clear port-security	555
clear rlir	556
clear rscn session	557
clear rscn statistics	558
clear zone	559
device-alias abort	560
device-alias commit	561
device-alias database	562
device-alias distribute	563
device-alias import fcalias	564
device-alias mode	565
device-alias name	566
device-alias rename	567
discover custom-list	568
discover scsi-target	569
fabric profile	571
fabric-binding activate	572
fabric-binding database copy	573
fabric-binding database diff	574
fabric-binding database vsan	575
fabric-binding enable	577
fcalias clone	578
fcalias name	579
fcalias rename	580
fcdomain	581
fcdomain abort vsan	583
fcdomain commit vsan	584
fcdomain distribute	585
fcdomain rcf-reject	586
fcdroplatency	587
fcflow stats	588
fcid-allocation	590
fcinterop fcid-allocation	591
fcns no-auto-poll	592
fcns proxy-port	593
fcns reject-duplicate-pwwn vsan	594
fcping	595
fcroute	597
fcs plat-check-global	599
fcs register	600
fcs virtual-device-add	601
fcsp	602
fcsp dhchap	604
fcsp enable	606
fcsp reauthenticate	607
fcsp timeout	608
fctimer	609
fctimer abort	610
fctimer commit	611
fctimer distribute	612
fctrace	613
fdmi suppress-updates	614
fspf config	615
fspf cost	617
fspf dead-interval	618
fspf enable	619
fspf hello-interval	620
fspf passive	621
fspf retransmit-interval	622
in-order-guarantee	623
interface fc	624
interface san-port-channel	626
interface vfc	628
logging abort	630
logging commit	631
logging distribute	632
member (fcalias configuration mode)	633
member (zone configuration mode)	635
member (zoneset configuration mode)	637
npiv enable	638
npv auto-load-balance disruptive	639
npv enable	640
npv traffic-map	641
port-security	642
port-security abort	644
port-security commit	645
port-security database	646
port-security distribute	648
port-security enable	649
port-track enable	650
port-track force-shut	651
port-track interface	652
purge fcdomain fcid	653
rlir preferred-cond fcid	654
rscn	656
rscn abort	657
rscn commit	658
rscn distribute	659
rscn event-tov	660
san-port-channel persistent	661
scsi-target	662
switchport	664
switchport ignore bit-errors	667
system default switchport	669
system default zone default-zone permit	671
system default zone distribute full	672
trunk protocol enable	673
vsan database	674
wwn secondary-mac	677
wwn vsan	678
zone clone	679
zone commit	680
zone compact	681
zone copy	682
zone default-zone	683
zone merge-control restrict vsan	684
zone mode enhanced	685

Match case Limit results 1 per page

Send comments to [email protected]

6-20

Cisco Nexus 5000 Series Command Reference

OL-16599-01

Chapter 6

Security Commands

deny (IPv4)

If you do not specify a sequence number, the switch assigns the rule a sequence number that is 10 greater

than the last rule in the ACL.

Command Modes

IPv4 ACL configuration

Command History

Usage Guidelines

When the switch applies an IPv4 ACL to a packet, it evaluates the packet with every rule in the ACL.

The switch enforces the first rule whose conditions are satisfied by the packet. When the conditions of

more than one rule are satisfied, the switch enforces the rule with the lowest sequence number.

Source and Destination

You can specify the

source

and

destination

arguments in one of several ways. In each rule, the method

that you use to specify one of these arguments does not affect how you specify the other argument. When

you configure a rule, use the following methods to specify the

source

and

destination

arguments:

•

IP address group object—You can use an IPv4 address group object to specify a

source

destination

argument. Use the

object-group ip address

command to create and change IPv4 address

group objects. The syntax is as follows:

addrgroup

address-group-name

The following example shows how to use an IPv4 address object group named lab-gateway-svrs to

specify the

destination

argument:

switch(config-acl)#

deny ip any addrgroup lab-gateway-svrs

•

Address and network wildcard—You can use an IPv4 address followed by a network wildcard to

specify a host or a network as a source or destination. The syntax is as follows:

IPv4-address network-wildcard

The following example shows how to specify the

source

argument with the IPv4 address and

network wildcard for the 192.168.67.0 subnet:

switch(config-acl)#

deny tcp 192.168.67.0 0.0.0.255 any

•

Address and variable-length subnet mask—You can use an IPv4 address followed by a

variable-length subnet mask (VLSM) to specify a host or a network as a source or destination. The

syntax is as follows:

IPv4-address/prefix-len

The following example shows how to specify the

source

argument with the IPv4 address and VLSM

for the 192.168.67.0 subnet:

switch(config-acl)#

deny udp 192.168.67.0/24 any

•

Host address—You can use the

host

keyword and an IPv4 address to specify a host as a source or

destination. The syntax is as follows:

host

IPv4-address

This syntax is equivalent to

IPv4-address

/32 and

IPv4-address

0.0.0.0.

Release

Modification

4.0(0)N1(1a)

This command was introduced.