Users Guide

Security Commands 1190
deny (management)
Use the deny command in Management Access-List Configuration mode to
set conditions for disallowing packets to flow to the switch management
function.
Syntax
deny vlan vlan-id | [service service ] [priority priority ]
deny ip-source
ip-address [mask mask | prefix-length ] [ vlan vlan-id ][service
service ] [priority priority ]
• vlan
vlan-id — A valid VLAN identifier.
•
ip-address — Source IP address.
• mask
mask — Specifies the network mask of the source IP address.
• mask
prefix-length — Specifies the number of bits that comprise the
source IP address prefix. The prefix length must be preceded by a forward
slash (/). (Range: 0–32)
• service
service — Indicates service type. Can be one of the following:
telnet, ssh, http, https, tftp, snmp, sntp, or any. The any keyword indicates
that the service match for the ACL is effectively “don’t care”.
• priority
priority — Priority for the rule. (Range: 1–64)
Default Configuration
This command has no default configuration.
Command Mode
Management Access-list Configuration mode
User Guidelines
Rules with a vlan parameter are valid only if an IP address is defined on the
appropriate VLAN interface. Ensure that each rule has a unique priority.
Example
The following example shows how all VLANs are denied in the access-list
called
mlist .