White Papers

Related
Commands
deny — assigns a filter to deny IP traffic.
deny tcp — assigns a filter to deny TCP traffic.
deny arp (for Extended MAC ACLs)
Configure an egress filter that drops ARP packets on egress ACL supported line cards. (For more information, refer to your line
card documentation).
Syntax
deny arp {destination-mac-address mac-address-mask | any} vlan vlan-id {ip-
address | any | opcode code-number} [count [byte]] [order] [log [interval
minutes] [threshold-in-msgs [count]] [monitor]
To remove this filter, you have two choices:
● Use the no seq sequence-number command if you know the filter’s sequence number.
● Use the no deny arp {destination-mac-address mac-address-mask | any} vlan
vlan-id {ip-address | any | opcode code-number} command.
Parameters
destination-mac-
address mac-
address-mask
Enter a MAC address and mask in the nn:nn:nn:nn:nn format.
For the MAC address mask, specify which bits in the MAC address must match.
The MAC ACL supports an inverse mask; therefore, a mask of ff:ff:ff:ff:ff:ff allows
entries that do not match and a mask of 00:00:00:00:00:00 only allows entries that
match exactly.
any
Enter the keyword any to match and drop any ARP traffic on the interface.
vlan vlan-id
Enter the keyword vlan and then enter the VLAN ID to filter traffic associated
with a specific VLAN. The range is 1 to 4094 and 1 to 2094 for ExaScale ( you can
use IDs 1 to 4094). To filter all VLAN traffic, specify VLAN 1.
ip-address
Enter an IP address in dotted decimal format (A.B.C.D) as the target IP address
of the ARP.
opcode code-number
Enter the keyword opcode and then enter the number of the ARP opcode. The
range is from 1 to 23.
count (OPTIONAL) Enter the keyword count to count packets processed by the filter.
byte (OPTIONAL) Enter the keyword byte to count bytes processed by the filter.
log (OPTIONAL) Enter the keyword log to enable the triggering of ACL log messages.
order (OPTIONAL) Enter the keyword order to specify the QoS priority for the ACL
entry. The range is from 0 to 254 (where 0 is the highest priority and 254 is the
lowest; lower order numbers have a higher priority) If you did not use the keyword
order, the ACLs have the lowest order by default (255).
threshold-in
msgs count
(OPTIONAL) Enter the threshold-in-msgs keyword followed by a value to
indicate the maximum number of ACL logs that can be generated, exceeding
which the generation of ACL logs is terminated with the seq, permit, or deny
commands. The threshold range is from 1 to 100.
interval minutes (OPTIONAL) Enter the keyword interval followed by the time period in minutes
at which ACL logs must be generated. The time interval range is from 1 to 10
minutes.
monitor (OPTIONAL) Enter the keyword monitor when the rule is describing the traffic
that you want to monitor and the ACL in which you are creating the rule is applied
to the monitored interface.
Access Control Lists (ACL) 199