Deployment Guide

ICMP
Message Type
Keywords
ICMP Message Type Name
port-unreachable Port unreachable
precedence-
unreachable
Precedence cutoff
protocol-
unreachable
Protocol unreachable
reassembly-
timeout
Reassembly timeout
redirect All redirects
router-
advertisement
Router discovery advertisements
router-
solicitation
Router discovery solicitations
source-quench Source quenches
source-route-
failed
Source route failed
time-exceeded All time exceeded
timestamp-reply Timestamp replies
timestamp-
request
Timestamp requests
traceroute Traceroute
ttl-exceeded TTL exceeded
unreachable All unreachables
deny tcp
Configure a filter that drops transmission control protocol (TCP) packets meeting the filter criteria.
C9000 Series
Syntax
deny tcp {source mask | any | host ip-address} [bit] [operator port
[port]] {destination mask | any | host ip-address} [dscp] [bit] [operator
port [port]] [count [bytes]] [order] [fragments] [log [interval minutes]
[threshold-in-msgs [count]] [monitor]
To remove this filter, you have two choices:
● Use the no seq sequence-number command if you know the filter’s sequence number.
● Use the no deny tcp {source mask | any | host ip-address} {destination mask
| any | host ip-address} command.
Parameters
source Enter the IP address of the network or host from which the packets are sent.
mask Enter a network mask in /prefix format (/x) or A.B.C.D. The mask, when specified
in A.B.C.D format, may be either contiguous or non-contiguous.
any Enter the keyword any to specify that all routes are subject to the filter.
host ip-address Enter the keyword host then the IP address to specify a host IP address.
Access Control Lists (ACL) 237