CLI Guide

deny tcp (for IPv6 ACLs)
Configure a filter that drops TCP packets that match the filter criteria.
Syntax
deny tcp {source address mask | any | host ipv6-address}
[operator port [port]] {destination address | any | host ipv6-
address} [bit] [operator port [port]] [count [byte]] [log
[interval minutes] [threshold-in-msgs [count]] [monitor]
To remove this filter, you have two choices:
• Use the no seq sequence-number command syntax if you know the filter’s
sequence number
• Use the no deny tcp {source address mask | any | host ipv6-
address} {destination address | any | host ipv6-address}
command
Parameters
source Enter the IP address of the network or host from which the
packets are sent.
mask Enter a network mask in /prefix format (/x) or A.B.C.D. The
mask, when specified in A.B.C.D format, may be either
contiguous or non-contiguous.
any Enter the keyword any to specify that all routes are subject
to the filter.
host ipv6–address Enter the keyword host then the IPv6 address to specify a
host IP address.
operator (OPTIONAL) Enter one of the following logical operand:
• eq = equal to
• neq = not equal to
• gt = greater than
• lt = less than
• range = inclusive range of ports (you must specify two
ports for the port command)
port Enter the application layer port number. Enter two port
numbers if using the range logical operand. The range is
from 0 to 65535. The following list includes some common
TCP port numbers:
• 23 = Telnet
• 20 and 21= FTP
• 25 = SMTP
• 169 = SNMP
Access Control Lists (ACL)
309