CLI Guide

NOTE: For more information, also refer to the Commands Common to all ACL Types and Common
MAC Access List Commands sections.
deny
To drop packets that match the filter criteria, configure a filter.
Syntax
deny {any | host mac-address | mac-source-address mac-source-
address-mask} {any | host mac-address | mac-destination-address
mac-destination-address-mask} [ethertype-operator] [count
[byte]]
To remove this filter, you have two choices:
• Use the no seq sequence-number command if you know the filter’s
sequence number.
• Use the no deny {any | host mac-address | mac-source-address
mac-source-address-mask} {any | host mac-address | mac-
destination-address mac-destination-address-mask} command.
Parameters
any Enter the keyword any to drop all packets.
host mac-address Enter the keyword host and then enter a MAC address to
drop packets with that host address.
mac-source-
address
Enter a MAC address in nn:nn:nn:nn:nn:nn format.
mac-source-
address-mask
Specify which bits in the MAC address must match.
The MAC ACL supports an inverse mask; therefore, a mask
of ff:ff:ff:ff:ff:ff allows entries that do not match and a mask
of 00:00:00:00:00:00 only allows entries that match
exactly.
mac-destination-
address
Enter the destination MAC address and mask in
nn:nn:nn:nn:nn:nn format.
mac-destination-
address-mask
Specify which bits in the MAC address must match.
The MAC ACL supports an inverse mask; therefore, a mask
of ff:ff:ff:ff:ff:ff allows entries that do not match and a mask
of 00:00:00:00:00:00 only allows entries that match
exactly.
ethertype
operator
(OPTIONAL) To filter based on protocol type, enter one of
the following Ethertypes:
• ev2 - is the Ethernet II frame format
• llc - is the IEEE 802.3 frame format
208
Access Control Lists (ACL)