Home » Dell Manuals » Hubs & Switches » Dell S3100 » Manual Viewer

Dell S3100 EMC Command Line Reference Guide for the Series 9.14.2.5 - Page 297

deny udp (for IPv6 ACLs

Add to My Manuals
Save this manual to your list of manuals

Page 297 highlights

Version 9.8(1.0) 9.8(0.0P5) 9.8(0.0P2) 9.8(0.0) 9.7(0.0) 9.5(0.1) 9.4(0.0) 9.3(0.0) Description Introduced on the Z9100-ON. Introduced on the S4048-ON. Introduced on the S3048-ON. Added the no-drop parameter. Introduced on the S6000-ON. Introduced on the Z9500. Added support for flow-based monitoring on the S4810, S4820T, S6000, and Z9000 platforms. Added support for logging of ACLs on the S4810, S4820T, and Z9000 platforms. Usage Information When the configured maximum threshold is exceeded, generation of logs is stopped. When the interval at which ACL logs are configured to be recorded expires, the subsequent, fresh interval timer is started and the packet count for that new interval commences from zero. If ACL logging was stopped previously because the configured threshold is exceeded, it is re-enabled for this new interval. If ACL logging is stopped because the configured threshold is exceeded, it is re-enabled after the logging interval period elapses. ACL logging is supported for standard and extended IPv4 ACLs, IPv6 ACLs, and MAC ACLs. You can configure ACL logging only on ACLs that are applied to ingress interfaces; you cannot enable logging for ACLs that are associated with egress interfaces. You can activate flow-based monitoring for a monitoring session by entering theflow-based enable command in the Monitor Session mode. When you enable this capability, traffic with particular flows that are traversing through the ingress and egress interfaces are examined and, appropriate ACLs can be applied in both the ingress and egress direction. Flow-based monitoring conserves bandwidth by monitoring only specified traffic instead all traffic on the interface. This feature is particularly useful when looking for malicious traffic. It is available for Layer 2 and Layer 3 ingress and egress traffic. You may specify traffic using standard or extended access-lists. This mechanism copies all incoming or outgoing packets on one port and forwards (mirrors) them to another port. The source port is the monitored port (MD) and the destination port is the monitoring port (MG). deny udp (for IPv6 ACLs) Configure a filter to drop user datagram protocol (UDP) packets meeting the filter criteria. Syntax deny udp {source address mask | any | host ipv6-address} [operator port [port]] {destination address | any | host ipv6-address} [operator port [port]] [ttl operator] [count [byte]] [log [interval minutes] [threshold-in-msgs [count]] [monitor] To remove this filter, you have two choices: • Use the no seq sequence-number command syntax if you know the filter's sequence number • Use the no deny udp {source address mask | any | host ipv6-address} {destination address | any | host ipv6-address} command Parameters ttl operator Enter the keyword ttl to deny a packet based on the time to live value. The range is from 1 to 255. Enter one of the following logical operand: • eq(equal to) - matches packets that contain a ttl value that is equal to the specified ttl value. • neq(not equal to) - matches packets that contain a ttl value that is not equal to the specified ttl value. • gt(greater than) - matches packets that contain a ttl value that is greater than the specified ttl value. • lt (less than) - matches packets that contain a ttl value that is less than the specified ttl value. Access Control Lists (ACL) 297

Section	Page
Dell EMC Command Line Reference Guide for the S3100 Series 9.14.2.5	3
About this Guide	40
Objectives	40
Audience	40
Conventions	40
CLI Basics	41
Accessing the Command Line	41
Multiple Configuration Users	41
Obtaining Help	42
Navigating the CLI	43
Using the no Command	43
Filtering show Commands	44
Enabling Software Features on Devices Using a Command Option	44
feature vrf	45
show feature	45
Command Modes	46
File Management	54
boot system	54
cd	55
copy	56
delete	59
dir	59
format	61
fsck flash	61
mkdir	62
mount nfs	63
rmdir	63
upgrade system	64
rename	66
restore factory-defaults	67
show boot system	69
show bootvar	70
show file-systems	71
show os-version	72
show running-config	73
show startup-config	77
show version	78
upgrade	79
Control and Monitoring	82
banner exec	82
banner login	83
banner motd	84
cam-acl	85
cam-acl-vlan	87
clear average-power	87
clear line	88
configure	88
disable	89
do	90
enable	91
enable optic-info-update interval	92
end	93
exec-timeout	94
exit	95
ftp-server enable	96
ftp-server topdir	97
ftp-server username	98
hostname	98
ip http source-interface	99
ip http vrf	100
ip ftp password	101
ip ftp source-interface	102
ip ftp username	103
ip ftp vrf	103
ip telnet server enable	104
ip telnet server vrf	105
ip telnet source-interface	105
ip telnet vrf	107
ip tftp source-interface	107
ip tftp vrf	108
line	109
login concurrent-session	110
login statistics	111
motd-banner	112
ping	113
reload	116
send	117
service timestamps	118
show alarms	119
show cam-acl-vlan	120
show command-history	121
show cpu-traffic-stats	122
show debugging	124
show environment	124
show inventory	126
show login statistics	127
show memory	129
show processes cpu	130
show processes ipc flow-control	133
show processes memory	134
show reset-reason	136
show software ifm	138
show system	139
show tech-support	141
ssh-peer-stack-unit	144
telnet	145
telnet-peer-stack-unit	146
terminal length	147
traceroute	147
undebug all	149
virtual-ip	150
write	151
802.1X	153
dot1x critical-vlan	154
debug dot1x	155
dot1x auth-fail-vlan	155
dot1x auth-server	156
dot1x auth-type mab-only	157
dot1x authentication (Configuration)	158
dot1x authentication (Interface)	158
dot1x guest-vlan	159
dot1x host-mode	160
dot1x mac-auth-bypass	161
dot1x max-eap-req	162
dot1x max-supplicants	163
dot1x port-control	163
dot1x profile	164
dot1x quiet-period	165
dot1x reauthentication	165
dot1x reauth-max	166
dot1x server-timeout	167
dot1x static-mab	168
dot1x supplicant-timeout	169
dot1x tx-period	169
mac	170
show dot1x cos-mapping interface	171
show dot1x interface	172
show dot1x profile	175
Access Control Lists (ACL)	176
Commands Common to all ACL Types	177
remark	177
show config	179
Common IP ACL Commands	179
access-class	180
clear counters ip access-group	181
ip access-group	181
ip control-plane egress-filter	183
show ip accounting access-list	183
show ip access-lists	185
Standard IP ACL Commands	186
deny	186
ip access-list standard	187
permit	188
resequence access-list	190
seq	191
Extended IP ACL Commands	192
deny	193
deny icmp	195
deny tcp	196
deny udp	199
ip access-list extended	202
permit	203
permit tcp	204
permit udp	207
resequence access-list	210
seq	211
Common MAC Access List Commands	213
clear counters mac access-group	213
mac access-group	214
show mac access-lists	215
show mac accounting access-list	216
Standard MAC ACL Commands	217
deny	217
mac access-list standard	219
permit	220
seq	221
Extended MAC ACL Commands	222
deny	222
mac access-list extended	224
permit	225
IP Prefix List Commands	227
clear ip prefix-list	227
deny	228
ip prefix-list	229
seq	230
show config	231
show ip prefix-list detail	231
show ip prefix-list summary	232
Route Map Commands	233
continue	233
description	234
match as-path	235
match community	236
match interface	237
match ip address	238
match ip next-hop	239
match ip route-source	240
match metric	240
match origin	241
match route-type	242
match tag	243
route-map	244
set as-path	245
set automatic-tag	246
set comm-list delete	247
set community	248
set level	249
set local-preference	250
set metric	251
set metric-type	251
set next-hop	252
set origin	253
set tag	254
set weight	255
show config	256
show route-map	257
AS-Path Commands	257
ip as-path access-list	258
show ip as-path-access-lists	258
IP Community List Commands	259
ip community-list	259
show ip community-lists	260
deny (for Standard IP ACLs)	260
deny (for Extended IP ACLs)	261
seq (for Standard IPv4 ACLs)	263
deny tcp (for Extended IP ACLs)	264
deny udp (for Extended IP ACLs)	266
deny arp (for Extended MAC ACLs)	267
deny icmp (for Extended IP ACLs)	268
deny ether-type (for Extended MAC ACLs)	269
deny (for Standard MAC ACLs)	270
deny (for Extended MAC ACLs)	272
permit (for Standard IP ACLs)	273
permit arp (for Extended MAC ACLs)	274
permit ether-type (for Extended MAC ACLs)	275
permit icmp (for Extended IP ACLs)	276
permit udp (for Extended IP ACLs)	278
permit (for Extended IP ACLs)	279
permit (for Standard MAC ACLs)	281
seq (for Standard MAC ACLs)	282
permit tcp (for Extended IP ACLs)	283
seq arp (for Extended MAC ACLs)	285
seq ether-type (for Extended MAC ACLs)	286
seq (for IP ACLs)	287
seq (for IPv6 ACLs)	289
permit udp (for IPv6 ACLs)	290
permit tcp (for IPv6 ACLs)	292
permit icmp (for IPv6 ACLs)	294
permit (for IPv6 ACLs)	296
deny udp (for IPv6 ACLs)	297
deny tcp (for IPv6 ACLs)	299
deny icmp (for Extended IPv6 ACLs)	301
deny (for IPv6 ACLs)	303
Access Control List (ACL) VLAN Groups and Content Addressable Memory (CAM)	305
member vlan	305
ip access-group	305
show acl-vlan-group	306
show cam-acl-vlan	307
cam-acl-vlan	308
show cam-usage	309
show running config acl-vlan-group	311
acl-vlan-group	312
show acl-vlan-group detail	312
description (ACL VLAN Group)	313
Bidirectional Forwarding Detection (BFD)	314
bfd all-neighbors	314
bfd disable	316
bfd enable (Configuration)	316
bfd enable (Interface)	317
bfd interval	317
bfd protocol-liveness	318
ip route bfd	319
ip ospf bfd all-neighbors	320
ipv6 ospf bfd all-neighbors	321
ipv6 route bfd	322
isis bfd all-neighbors	323
neighbor bfd	324
neighbor bfd disable	325
show bfd neighbors	325
vrrp bfd neighbor	327
Border Gateway Protocol	329
BGP IPv4 Commands	329
address-family	329
aggregate-address	330
bgp add-path	331
bgp always-compare-med	332
bgp asnotation	333
bgp bestpath as-path ignore	334
bgp bestpath as-path multipath-relax	335
bgp bestpath med confed	335
bgp bestpath med missing-as-best	336
bgp bestpath router-id ignore	337
bgp client-to-client reflection	337
bgp cluster-id	338
bgp confederation identifier	339
bgp confederation peers	340
bgp connection-retry-timer	341
bgp dampening	341
bgp default local-preference	342
bgp dmzlink-bw	343
bgp enforce-first-as	344
bgp fast-external-fallover	344
bgp four-octet-as-support	345
bgp graceful-restart	346
bgp non-deterministic-med	347
bgp outbound-optimization	348
bgp outbound-optimization	348
bgp recursive-bgp-next-hop	349
bgp regex-eval-optz-disable	349
bgp router-id	351
clear ip bgp	351
clear ip bgp dampening	353
clear ip bgp flap-statistics	354
clear ip bgp peer-group	355
deny bandwidth	356
debug ip bgp	357
debug ip bgp dampening	358
debug ip bgp events	359
debug ip bgp keepalives	360
debug ip bgp notifications	361
debug ip bgp soft-reconfiguration	361
debug ip bgp updates	362
default-metric	363
description	364
maximum-paths	365
neighbor activate	366
neighbor add-path	367
neighbor advertisement-interval	368
neighbor advertisement-start	369
neighbor allowas-in	369
neighbor default-originate	370
neighbor description	371
neighbor distribute-list	372
neighbor ebgp-multihop	373
neighbor fall-over	374
neighbor local-as	375
neighbor maximum-prefix	376
neighbor next-hop-self	377
neighbor password	377
neighbor peer-group (assigning peers)	378
neighbor peer-group (creating group)	380
neighbor peer-group passive	380
neighbor remote-as	381
neighbor remove-private-as	382
neighbor route-map	383
neighbor route-reflector-client	384
neighbor sender-side-loopdetect	385
neighbor send-community	386
neighbor shutdown	387
neighbor soft-reconfiguration inbound	388
neighbor timers	389
neighbor timers extended	390
neighbor update-source	390
neighbor weight	391
network	392
network backdoor	393
permit bandwidth	394
redistribute	395
redistribute ospf	396
router bgp	397
shutdown all	398
shutdown address-family-ipv4–multicast	398
shutdown address-family-ipv4–unicast	398
shutdown address-family-ipv6–unicast	399
set extcommunity bandwidth	399
show capture bgp-pdu neighbor	400
show config	401
show ip bgp	402
show ip bgp cluster-list	405
show ip bgp community	407
show ip bgp community-list	409
show ip bgp dampened-paths	410
show ip bgp detail	412
show ip bgp extcommunity-list	413
show ip bgp filter-list	414
show ip bgp flap-statistics	416
show ip bgp inconsistent-as	417
show ip bgp neighbors	419
show ip bgp next-hop	422
show ip bgp paths	423
show ip bgp paths community	425
show ip bgp peer-group	426
show ip bgp regexp	427
show ip bgp summary	429
show running-config bgp	431
timers bgp	432
timers bgp extended	432
MBGP Commands	433
debug ip bgp dampening	433
distance bgp	434
show ip bgp dampened-paths	435
BGP Extended Communities (RFC 4360)	436
set extcommunity rt	436
set extcommunity soo	437
show ip bgp paths extcommunity	438
show ip extcommunity-list	439
IPv6 BGP Commands	440
clear ip bgp ipv6 unicast soft	440
debug ip bgp ipv6 unicast soft-reconfiguration	441
ipv6 prefix-list	441
neighbor soft-reconfiguration inbound	442
show ipv6 prefix-list	443
IPv6 MBGP Commands	443
show ipv6 mbgproutes	443
Content Addressable Memory (CAM)	445
CAM Profile Commands	445
cam-acl (Configuration)	445
cam-acl-egress	448
cam-optimization	448
cam-threshold	449
show cam-acl	450
show cam-usage	452
test cam-usage	453
Control Plane Policing (CoPP)	455
control-plane-cpuqos	455
service-policy rate-limit-cpu-queues	456
service-policy rate-limit-protocols	456
ip unknown-unicast	457
ipv6 unknown-unicast	458
show cpu-queue rate cp	458
show ip protocol-queue-mapping	459
show ipv6 protocol-queue-mapping	460
show mac protocol-queue-mapping	461
Debugging and Diagnostics	463
Diagnostics and Monitoring Commands	463
logging coredump stack-unit	463
Offline Diagnostic Commands	464
diag stack-unit	464
offline stack-unit	465
online stack-unit	466
Hardware Commands	467
clear hardware stack-unit	467
clear hardware system-flow	468
clear hardware vlan-counters	468
hardware watchdog	469
show hardware mac	469
show hardware ip	470
show hardware stack-unit	471
show hardware buffer interface	478
show hardware counters interface	480
show hardware buffer-stats-snapshot	481
show hardware stack-unit buffer-stats-snapshot (Total Buffer Information)	482
show hardware system-flow	484
show hardware vlan-counters	485
show hardware drops	486
Dynamic Host Configuration Protocol (DHCP)	489
Commands to Configure the System to be a DHCP Server	489
clear ip dhcp	489
debug ip dhcp server	490
debug ipv6 dhcp	490
default-router	491
disable	492
dns-server	492
domain-name	493
excluded-address	494
hardware-address	494
host-address	495
ip dhcp server	495
lease	496
netbios-name-server	497
netbios-node-type	497
network	498
pool	499
show ip dhcp binding	499
show ip dhcp configuration	500
show ip dhcp conflict	501
show ip dhcp server	502
Commands to Configure Secure DHCP	502
arp inspection	502
arp inspection-limit	503
arp inspection-trust	503
clear ip dhcp snooping	504
clear ipv6 dhcp snooping binding	505
ip dhcp relay	506
ip dhcp snooping	507
ipv6 dhcp snooping	507
ipv6 dhcp snooping vlan	508
ip dhcp snooping binding	508
IPv6 DHCP Snooping Binding	510
ip dhcp snooping database	510
ipv6 dhcp snooping database write-delay	511
ip dhcp snooping database renew	512
ipv6 dhcp snooping database renew	512
ip dhcp snooping trust	513
ipv6 dhcp snooping trust	513
ip dhcp source-address-validation	514
ip dhcp relay information-option	515
ip dhcp relay source-interface	516
ipv6 dhcp relay source-interface	516
ip dhcp snooping verify mac-address	517
ipv6 dhcp snooping verify mac-address	518
ip helper-address	518
ipv6 helper-address	519
show ip dhcp snooping	520
show ipv6 dhcp snooping	522
Commands to Configure DNS	523
ip name-server	523
ip domain-name	523
ip domain-list	524
ip host	525
clear host	526
Equal Cost Multi-Path (ECMP)	527
ecmp-group	527
hash-algorithm	528
ip ecmp-group	530
ip ecmp weighted	530
link-bundle-monitor enable	531
link-bundle-distribution trigger-threshold	532
show config	532
show link-bundle distribution	533

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1,000
1,001
1,002
1,003
1,004
1,005
1,006
1,007
1,008
1,009
1,010
1,011
1,012
1,013
1,014
1,015
1,016
1,017
1,018
1,019
1,020
1,021
1,022
1,023
1,024
1,025
1,026
1,027
1,028
1,029
1,030
1,031
1,032
1,033
1,034
1,035
1,036
1,037
1,038
1,039
1,040
1,041
1,042
1,043
1,044
1,045
1,046
1,047
1,048
1,049
1,050
1,051
1,052
1,053
1,054
1,055
1,056
1,057
1,058
1,059
1,060
1,061
1,062
1,063
1,064
1,065
1,066
1,067
1,068
1,069
1,070
1,071
1,072
1,073
1,074
1,075
1,076
1,077
1,078
1,079
1,080
1,081
1,082
1,083
1,084
1,085
1,086
1,087
1,088
1,089
1,090
1,091
1,092
1,093
1,094
1,095
1,096
1,097
1,098
1,099
1,100
1,101
1,102
1,103
1,104
1,105
1,106
1,107
1,108
1,109
1,110
1,111
1,112
1,113
1,114
1,115
1,116
1,117
1,118
1,119
1,120
1,121
1,122
1,123
1,124
1,125
1,126
1,127
1,128
1,129
1,130
1,131
1,132
1,133
1,134
1,135
1,136
1,137
1,138
1,139
1,140
1,141
1,142
1,143
1,144
1,145
1,146
1,147
1,148
1,149
1,150
1,151
1,152
1,153
1,154
1,155
1,156
1,157
1,158
1,159
1,160
1,161
1,162
1,163
1,164
1,165
1,166
1,167
1,168
1,169
1,170
1,171
1,172
1,173
1,174
1,175
1,176
1,177
1,178
1,179
1,180
1,181
1,182
1,183
1,184
1,185
1,186
1,187
1,188
1,189
1,190
1,191
1,192
1,193
1,194
1,195
1,196
1,197
1,198
1,199
1,200
1,201
1,202
1,203
1,204
1,205
1,206
1,207
1,208
1,209
1,210
1,211
1,212
1,213
1,214
1,215
1,216
1,217
1,218
1,219
1,220
1,221
1,222
1,223
1,224
1,225
1,226
1,227
1,228
1,229
1,230
1,231
1,232
1,233
1,234
1,235
1,236
1,237
1,238
1,239
1,240
1,241
1,242
1,243
1,244
1,245
1,246
1,247
1,248
1,249
1,250
1,251
1,252
1,253
1,254
1,255
1,256
1,257
1,258
1,259
1,260
1,261
1,262
1,263
1,264
1,265
1,266
1,267
1,268
1,269
1,270
1,271
1,272
1,273
1,274
1,275
1,276
1,277
1,278
1,279
1,280
1,281
1,282
1,283
1,284
1,285
1,286
1,287
1,288
1,289
1,290
1,291
1,292
1,293
1,294
1,295
1,296
1,297
1,298
1,299
1,300
1,301
1,302
1,303
1,304
1,305
1,306
1,307
1,308
1,309
1,310
1,311
1,312
1,313
1,314
1,315
1,316
1,317
1,318
1,319
1,320
1,321
1,322
1,323
1,324
1,325
1,326
1,327
1,328
1,329
1,330
1,331
1,332
1,333
1,334
1,335
1,336
1,337
1,338
1,339
1,340
1,341
1,342
1,343
1,344
1,345
1,346
1,347
1,348
1,349
1,350
1,351
1,352
1,353
1,354
1,355
1,356
1,357
1,358
1,359
1,360
1,361
1,362
1,363
1,364
1,365
1,366
1,367
1,368
1,369
1,370
1,371
1,372
1,373
1,374
1,375
1,376
1,377
1,378
1,379
1,380
1,381
1,382
1,383
1,384
1,385
1,386
1,387
1,388
1,389
1,390
1,391
1,392
1,393
1,394
1,395
1,396
1,397
1,398
1,399
1,400
1,401
1,402
1,403
1,404
1,405
1,406
1,407
1,408
1,409
1,410
1,411
1,412
1,413
1,414
1,415
1,416
1,417
1,418
1,419
1,420
1,421
1,422
1,423
1,424
1,425
1,426
1,427
1,428
1,429
1,430
1,431
1,432
1,433
1,434
1,435
1,436
1,437
1,438
1,439
1,440
1,441
1,442
1,443
1,444
1,445
1,446
1,447
1,448
1,449
1,450
1,451
1,452
1,453
1,454
1,455
1,456
1,457
1,458
1,459
1,460
1,461
1,462
1,463
1,464
1,465
1,466
1,467
1,468
1,469
1,470
1,471
1,472
1,473
1,474
1,475
1,476
1,477
1,478
1,479
1,480
1,481
1,482
1,483
1,484
1,485
1,486
1,487
1,488
1,489
1,490
1,491
1,492
1,493
1,494
1,495
1,496
1,497
1,498
1,499
1,500
1,501
1,502
1,503
1,504
1,505
1,506
1,507
1,508
1,509
1,510
1,511
1,512
1,513
1,514
1,515
1,516
1,517
1,518
1,519
1,520
1,521
1,522
1,523
1,524
1,525
1,526
1,527
1,528
1,529
1,530
1,531
1,532
1,533
1,534
1,535
1,536
1,537
1,538
1,539
1,540
1,541
1,542
1,543
1,544
1,545
1,546
1,547
1,548
1,549
1,550
1,551
1,552
1,553
1,554
1,555
1,556
1,557
1,558
1,559
1,560
1,561
1,562
1,563
1,564
1,565
1,566
1,567
1,568
1,569
1,570
1,571
1,572
1,573
1,574
1,575
1,576
1,577
1,578
1,579
1,580
1,581
1,582
1,583
1,584
1,585
1,586
1,587
1,588
1,589
1,590
1,591
1,592
1,593
1,594
1,595
1,596
1,597
1,598
1,599
1,600
1,601
1,602
1,603
1,604
1,605
1,606
1,607
1,608
1,609
1,610
1,611
1,612
1,613
1,614
1,615
1,616
1,617
1,618
1,619
1,620
1,621
1,622
1,623
1,624
1,625
1,626
1,627
1,628
1,629
1,630
1,631
1,632
1,633
1,634
1,635
1,636
1,637
1,638
1,639
1,640
1,641
1,642
1,643
1,644
1,645
1,646
1,647
1,648
1,649
1,650
1,651
1,652

Match case Limit results 1 per page

Version

Description

9.8(1.0)

Introduced on the Z9100–ON.

9.8(0.0P5)

Introduced on the S4048-ON.

9.8(0.0P2)

Introduced on the S3048-ON.

9.8(0.0)

Added the no-drop parameter.

9.7(0.0)

Introduced on the S6000–ON.

9.5(0.1)

Introduced on the Z9500.

9.4(0.0)

Added support for flow-based monitoring on the S4810, S4820T, S6000, and Z9000

platforms.

9.3(0.0)

Added support for logging of ACLs on the S4810, S4820T, and Z9000 platforms.

Usage Information

When the configured maximum threshold is exceeded, generation of logs is stopped. When the interval at which

ACL logs are configured to be recorded expires, the subsequent, fresh interval timer is started and the packet

count for that new interval commences from zero. If ACL logging was stopped previously because the configured

threshold is exceeded, it is re-enabled for this new interval.

If ACL logging is stopped because the configured threshold is exceeded, it is re-enabled after the logging interval

period elapses. ACL logging is supported for standard and extended IPv4 ACLs, IPv6 ACLs, and MAC ACLs. You

can configure ACL logging only on ACLs that are applied to ingress interfaces; you cannot enable logging for ACLs

that are associated with egress interfaces.

You can activate flow-based monitoring for a monitoring session by entering the

flow-based enable

command in the Monitor Session mode. When you enable this capability, traffic with particular flows that are

traversing through the ingress and egress interfaces are examined and, appropriate ACLs can be applied in both

the ingress and egress direction. Flow-based monitoring conserves bandwidth by monitoring only specified traffic

instead all traffic on the interface. This feature is particularly useful when looking for malicious traffic. It is available

for Layer 2 and Layer 3 ingress and egress traffic. You may specify traffic using standard or extended access-lists.

This mechanism copies all incoming or outgoing packets on one port and forwards (mirrors) them to another port.

The source port is the monitored port (MD) and the destination port is the monitoring port (MG).

deny udp (for IPv6 ACLs)

Configure a filter to drop user datagram protocol (UDP) packets meeting the filter criteria.

Syntax

deny udp {

source address mask

| any | host

ipv6-address

} [

operator port

[

port

]]

{

destination address

| any | host

ipv6-address

} [

operator port

[

port

]] [ttl

operator

] [count [byte]] [log [interval

minutes

] [threshold-in-msgs [

count

]]

[monitor]

To remove this filter, you have two choices:

•

Use the

no seq sequence-number

command syntax if you know the filter’s sequence number

•

Use the

no deny udp {

source address mask

| any | host

ipv6-address

}

{

destination address

| any | host

ipv6-address

}

command

Parameters

ttl

Enter the keyword

ttl

to deny a packet based on the time to live value. The range is

from 1 to 255.

operator

Enter one of the following logical operand:

•

(equal to) — matches packets that contain a ttl value that is equal to the specified

ttl value.

•

neq

(not equal to) — matches packets that contain a ttl value that is not equal to the

specified ttl value.

•

(greater than) — matches packets that contain a ttl value that is greater than the

specified ttl value.

•

(less than) — matches packets that contain a ttl value that is less than the

specified ttl value.

Access Control Lists (ACL)

297