Users Guide

Usage Information
The order option is relevant in the context of the Policy QoS feature only. The following applies:
• The seq sequence-number command is applicable only in an ACL group.
• The order option works across ACL groups that are applied on an interface via the QoS policy framework.
• The order option takes precedence over seq sequence-number.
• If you do not congure sequence-number, the rules with the same order value are ordered according to
their conguration order.
• If you congure sequence-number, the sequence-number is used as a tie breaker for rules with the same
order.
Related Commands
• deny — congure a lter to drop packets.
• permit — congure a lter to forward packets.
Extended IP ACL Commands
When an ACL is created without any rule and then applied to an interface, ACL behavior reects an implicit permit.
The following commands congure extended IP ACLs, which in addition to the IP address, also examine the packet’s protocol type.
The platform supports both Ingress and Egress IP ACLs.
NOTE
: Also refer to the Commands Common to all ACL Types and Common IP ACL Commands sections.
deny
Congure a lter that drops IP packets meeting the lter criteria.
Syntax
deny {ip | ip-protocol-number} {source mask | any | host ip-address}
{destination mask | any | host ip-address} [count [byte] | log] [dscp value]
[order] [monitor] [fragments] [no-drop]
To remove this lter, you have two choices:
• Use the no seq sequence-number command if you know the lter’s sequence number.
•
Use the no deny {ip | ip-protocol-number} {source mask | any | host ip-address}
{destination mask | any | host ip-address} command.
Parameters
ip Enter the keyword ip to congure a generic IP access list. The keyword ip species that
the access list denies all IP protocols.
ip-protocol-number Enter a number from 0 to 255 to deny based on the protocol identied in the IP protocol
header.
source Enter the IP address of the network or host from which the packets were sent.
mask Enter a network mask in /prex format (/x) or A.B.C.D. The mask, when specied in
A.B.C.D format, may be either contiguous or noncontiguous.
any Enter the keyword any to specify that all routes are subject to the lter.
host ip-address Enter the keyword host then the IP address to specify a host IP address.
destination Enter the IP address of the network or host to which the packets are sent.
count (OPTIONAL) Enter the keyword count to count packets that the lter processes.
Access Control Lists (ACL) 191