Reference Guide

When you use the log option, the CP processor logs detail the packets that match.
Depending on how many packets match the log entry and at what rate, the CP
may become busy as it has to log these packets’ details.
Use the monitor option only when you are using flow-based monitoring. For
more information, refer to the Port Monitoring chapter of the
C9000 Series
Configuration Guide.
By default, 10 ACL logs are generated if you do not specify the threshold explicitly.
The default frequency at which ACL logs are generated is five minutes. By default,
flow-based monitoring is not enabled.
Related
Commands
deny tcp — assigns a filter to deny TCP packets.
deny udp — assigns a filter to deny UDP packets.
ip access-list extended — creates an extended ACL.
deny icmp
To drop all or specific internet control message protocol (ICMP) messages, configure a filter.
C9000 Series
Syntax
deny icmp {source–ip—address mask | any | host ip-address}
{destination mask | any | host ip-address} [log] [dscp] [[count
[bytes]] [order] [monitor] [fragments]
To remove this filter, you have two choices:
• Use the no seq sequence-number command if you know the filter’s
sequence number.
• Use the no deny icmp {source–ip—address mask | any | host ip-
address} {destination mask | any | host ip-address} command.
Parameters
source-ip-address Enter the IP address of the network or host from which the
packets were sent.
mask Enter a network mask in /prefix format (/x) or A.B.C.D. The
mask, when specified in A.B.C.D format, may be either
contiguous or non-contiguous.
any Enter the keyword any to specify that all routes are subject
to the filter.
host ip-address Enter the keyword host then the IP address to specify a
host IP address.
destination Enter the IP address of the network or host to which the
packets are sent.
log (OPTIONAL) Enter the keyword log to include ACL matches
in the log.
Access Control Lists (ACL)
271