Users Guide

NOTE: When you congure ACL logging and byte counters simultaneously, byte counters may display an
incorrect value. Congure packet counters with logging instead.
Related Commands
• deny tcp — assign a lter to deny TCP packets.
• deny udp — assign a lter to deny UDP packets.
• ip access-list extended — create an extended ACL.
deny icmp
To drop all or specic internet control message protocol (ICMP) messages, congure a lter.
Syntax
deny icmp {source mask | any | host ip-address} {destination mask | any | host
ip-address} [ttl operator] [dscp] [count [byte] [order] [fragments] [monitor]
[no-drop]
To remove this lter, you have two choices:
• Use the no seq sequence-number command if you know the lter’s sequence number.
•
Use the no deny icmp {source mask | any | host ip-address} {destination mask |
any | host ip-address} command.
Parameters
source Enter the IP address of the network or host from which the packets were sent.
mask Enter a network mask in /prex format (/x) or A.B.C.D. The mask, when specied in
A.B.C.D format, may be either contiguous or non-contiguous.
any Enter the keyword any to specify that all routes are subject to the lter.
host ip-address Enter the keyword host then the IP address to specify a host IP address.
destination Enter the IP address of the network or host to which the packets are sent.
ttl Enter the keyword ttl to deny a packet based on the time to live value. The range is
from 1 to 255.
operator Enter one of the following logical operand:
• eq(equal to) — matches packets that contain a ttl value that is equal to the specied
ttl value.
• neq(not equal to) — matches packets that contain a ttl value that is not equal to the
specied ttl value.
•
gt(greater than) — matches packets that contain a ttl value that is greater than the
specied ttl value.
• lt (less than) — matches packets that contain a ttl value that is less than the
specied ttl value.
• range(inclusive range of values) — matches packets that contain a ttl value that
falls between the specied range of ttl values.
dscp Enter this keyword dscp to deny a packet based on the DSCP value. The range is from 0
to 63.
count (OPTIONAL) Enter the keyword count to count packets processed by the lter.
byte (OPTIONAL) Enter the keyword byte to count bytes processed by the lter.
Access Control Lists (ACL) 227