Table Of Contents
D Commands
deadtime
deny (ARP)
deny (IPv4)
deny (MAC)
deny (role-based access control list)
description (identity policy)
description (user role)
device
dot1x default
dot1x host-mode
dot1x initialize
dot1x mac-auth-bypass
dot1x max-reauth-req
dot1x max-req
dot1x port-control
dot1x radius-accounting
dot1x re-authentication (EXEC)
dot1x re-authentication (global configuration and interface configuration)
dot1x system-auth-control
dot1x timeout quiet-period
dot1x timeout ratelimit-period
dot1x timeout re-authperiod
dot1x timeout server-timeout
dot1x timeout supp-timeout
dot1x timeout tx-period
D Commands
This chapter describes the Cisco NX-OS security commands that begin with D.
deadtime
To configure the dead-time interval for a RADIUS or TACACS+ server group, use the deadtime command. To revert to the default, use the no form of this command.
deadtime minutes
no deadtime minutes
Syntax Description
minutes
|
Number of minutes for the interval. The range is from 0 to 1440 minutes.
Note  Setting the dead-time interval to 0 disables the timer.
|
Defaults
0 minutes
Command Modes
RADlUS server group configuration
TACACS+ server group configuration
Supported User Roles
network-admin
vdc-admin
Command History
Release
|
Modification
|
4.0(1)
|
This command was introduced.
|
Usage Guidelines
You must use the feature tacacs+ command before you configure TACACS+.
This command does not require a license.
Examples
This example shows how to set the dead-time interval to 2 minutes for a RADIUS server group:
switch(config)# aaa group server radius RadServer
switch(config-radius)# deadtime 2
This example shows how to set the dead-time interval to 5 minutes for a TACACS+ server group:
switch(config)# feature tacacs+
switch(config)# aaa group server tacacs+ TacServer
switch(config-tacacs+)# deadtime 5
This example shows how to revert to the dead-time interval default:
switch(config)# feature tacacs+
switch(config)# aaa group server tacacs+ TacServer
switch(config-tacacs+)# no deadtime 5
Related Commands
Command
|
Description
|
aaa group server
|
Configures AAA server groups.
|
radius-server host
|
Configures a RADIUS server.
|
show radius-server groups
|
Displays RADIUS server group information.
|
show tacacs-server groups
|
Displays TACACS+ server group information.
|
feature tacacs+
|
Enables TACACS+.
|
tacacs-server host
|
Configures a TACACS+ server.
|
deny (ARP)
To create an ARP ACL rule that denies ARP traffic that matches its conditions, use the deny command. To remove a rule, use the no form of this command.
General Syntax
[sequence-number] deny ip {any | host sender-IP | sender-IP sender-IP-mask} mac {any | host
sender-MAC | sender-MAC sender-MAC-mask} [log]
[sequence-number] deny request ip {any | host sender-IP | sender-IP sender-IP-mask} mac {any
| host sender-MAC | sender-MAC sender-MAC-mask} [log]
[sequence-number] deny response ip {any | host sender-IP | sender-IP sender-IP-mask} {any |
host target-IP | target-IP target-IP-mask} mac {any | host sender-MAC |
sender-MAC sender-MAC-mask} [any | host target-MAC | target-MAC target-MAC-mask] [log]
no sequence-number
no deny ip {any | host sender-IP | sender-IP sender-IP-mask} mac {any | host sender-MAC |
sender-MAC sender-MAC-mask} [log]
no deny request ip {any | host sender-IP | sender-IP sender-IP-mask} mac {any | host
sender-MAC | sender-MAC sender-MAC-mask} [log]
no deny response ip {any | host sender-IP | sender-IP sender-IP-mask} {any | host target-IP |
target-IP target-IP-mask} mac {any | host sender-MAC | sender-MAC sender-MAC-mask}
[any | host target-MAC | target-MAC target-MAC-mask] [log]
Syntax Description
sequence-number
|
(Optional) Sequence number of the deny command, which causes the device to insert the command in that numbered position in the access list. Sequence numbers maintain the order of rules within an ACL.
A sequence number can be any integer between 1 and 4294967295.
By default, the first rule in an ACL has a sequence number of 10.
If you do not specify a sequence number, the device adds the rule to the end of the ACL and assigns a sequence number that is 10 greater than the sequence number of the preceding rule.
Use the resequence command to reassign sequence numbers to rules.
|
ip
|
Introduces the IP address portion of the rule.
|
any
|
(Optional) Specifies that any host matches the part of the rule that contains the any keyword. You can use the any to specify the sender IP address, target IP address, sender MAC address, and target MAC address.
|
host sender-IP
|
(Optional) Specifies that the rule matches ARP packets only when the sender IP address in the packet matches the value of the sender-IP argument. Valid values for the sender-IP argument are IPv4 addresses in dotted-decimal format.
|
sender-IP sender-IP-mask
|
(Optional) IPv4 address and mask for the set of IPv4 addresses that the sender IP address in the packet can match. The sender-IP and sender-IP-mask argument must be given in dotted-decimal format. Specifying 255.255.255.255 as the sender-IP-mask argument is the equivalent of using the host keyword.
|
mac
|
Introduces the MAC address portion of the rule.
|
host sender-MAC
|
(Optional) Specifies that the rule matches ARP packets only when the sender MAC address in the packet matches the value of the sender-MAC argument. Valid values for the sender-MAC argument are MAC addresses in dotted-hexadecimal format.
|
sender-MAC sender-MAC-mask
|
(Optional) MAC address and mask for the set of MAC addresses that the sender MAC address in the packet can match. The sender-MAC and sender-MAC-mask argument must be given in dotted-hexadecimal format. Specifying ffff.ffff.ffff as the sender-MAC-mask argument is the equivalent of using the host keyword.
|
log
|
(Optional) Specifies that the device logs ARP packets that match the rule.
|
request
|
(Optional) Specifies that the rule applies only to packets containing ARP request messages.
Note If you omit both the request and the response keywords, the rule applies to all ARP messages.
|
response
|
(Optional) Specifies that the rule applies only to packets containing ARP response messages.
Note If you omit both the request and the response keywords, the rule applies to all ARP messages.
|
host target-IP
|
(Optional) Specifies that the rule matches ARP packets only when the target IP address in the packet matches the value of the target-IP argument. You can specify host target-IP only when you use the response keyword. Valid values for the target-IP argument are IPv4 addresses in dotted-decimal format.
|
target-IP target-IP-mask
|
(Optional) IPv4 address and mask for the set of IPv4 addresses that the target IP address in the packet can match. You can specify target-IP target-IP-mask only when you use the response keyword. The target-IP and target-IP-mask argument must be given in dotted-decimal format. Specifying 255.255.255.255 as the target-IP-mask argument is the equivalent of using the host keyword.
|
host target-MAC
|
(Optional) Specifies that the rule matches ARP packets only when the target MAC address in the packet matches the value of the target-MAC argument. You can specify host target-MAC only when you use the response keyword. Valid values for the target-MAC argument are MAC addresses in dotted-hexadecimal format.
|
target-MAC target-MAC-mask
|
(Optional) MAC address and mask for the set of MAC addresses that the target MAC address in the packet can match. You can specify target-MAC target-MAC-mask only when you use the response keyword. The target-MAC and target-MAC-mask argument must be given in dotted-hexadecimal format. Specifying ffff.ffff.ffff as the target-MAC-mask argument is the equivalent of using the host keyword.
|
Defaults
None
Command Modes
ARP ACL configuration
Supported User Roles
network-admin
vdc-admin
Command History
Release
|
Modification
|
4.0(1)
|
This command was introduced.
|
Usage Guidelines
A newly created ARP ACL contains no rules.
If you do not specify a sequence number, the device assigns to the rule a sequence number that is 10 greater than the last rule in the ACL.
When the device applies an ARP ACL to a packet, it evaluates the packet with every rule in the ACL. The device enforces the first rule that has conditions that are satisfied by the packet. When the conditions of more than one rule are satisfied, the device enforces the rule with the lowest sequence number.
If you do not specify either the response or request keyword, the rule applies to packets that contain any ARP message.
This command does not require a license.
Examples
This example shows how to enter ARP access list configuration mode for an ARP ACL named arp-acl-01 and add a rule that denies ARP request messages that contain a sender IP address that is within the 10.32.143.0 subnet:
switch(config)# arp access-list arp-acl-01
switch(config-arp-acl)# deny request ip 10.32.143.0 255.255.255.0 mac any
Related Commands
Command
|
Description
|
arp access-list
|
Configures an ARP ACL.
|
ip arp inspection filter
|
Applies an ARP ACL to a VLAN.
|
permit (ARP)
|
Configures a permit rule in an ARP ACL.
|
remark
|
Configures a remark in an ACL.
|
show arp access-list
|
Displays all ARP ACLs or one ARP ACL.
|
deny (IPv4)
To create an IPv4 ACL rule that denies traffic matching its conditions, use the deny command. To remove a rule, use the no form of this command.
General Syntax
[sequence-number] deny protocol source destination [dscp dscp | precedence precedence]
[fragments] [log] [time-range time-range-name]
no deny protocol source destination [dscp dscp | precedence precedence] [fragments] [log]
[time-range time-range-name]
no sequence-number
Internet Control Message Protocol
[sequence-number] deny icmp source destination [icmp-message] [dscp dscp | precedence
precedence] [fragments] [log] [time-range time-range-name]
Internet Group Management Protocol
[sequence-number] deny igmp source destination [igmp-message] [dscp dscp | precedence
precedence] [fragments] [log] [time-range time-range-name]
Internet Protocol v4
[sequence-number] deny ip source destination [dscp dscp | precedence precedence] [fragments]
[log] [time-range time-range-name]
Transmission Control Protocol
[sequence-number] deny tcp source [operator port [port] | portgroup portgroup] destination
[operator port [port] | portgroup portgroup] [dscp dscp | precedence precedence] [fragments]
[log] [time-range time-range-name] [flags] [established]
User Datagram Protocol
[sequence-number] deny udp source [operator port [port] | portgroup portgroup] destination
[operator port [port] | portgroup portgroup] [dscp dscp | precedence precedence] [fragments]
[log] [time-range time-range-name]
Syntax Description
sequence-number
|
(Optional) Sequence number of the deny command, which causes the device to insert the command in that numbered position in the access list. Sequence numbers maintain the order of rules within an ACL.
A sequence number can be any integer between 1 and 4294967295.
By default, the first rule in an ACL has a sequence number of 10.
If you do not specify a sequence number, the device adds the rule to the end of the ACL and assigns a sequence number that is 10 greater than the sequence number of the preceding rule.
Use the resequence command to reassign sequence numbers to rules.
|
protocol
|
Name or number of the protocol of packets that the rule matches. Valid numbers are from 0 to 255. Valid protocol names are the following keywords:
•icmp—Specifies that the rule applies to ICMP traffic only. When you use this keyword, the icmp-message argument is available, in addition to the keywords that are available for all valid values of the protocol argument.
•igmp—Specifies that the rule applies to IGMP traffic only. When you use this keyword, the igmp-type argument is available, in addition to the keywords that are available for all valid values of the protocol argument.
•ip—Specifies that the rule applies to all IPv4 traffic. When you use this keyword, only the other keywords and arguments that apply to all IPv4 protocols are available. They include the following:
–dscp
–fragments
–log
–precedence
–time-range
•tcp—Specifies that the rule applies to TCP traffic only. When you use this keyword, the flags and operator arguments and the portgroup and established keywords are available, in addition to the keywords that are available for all valid values of the protocol argument.
•udp—Specifies that the rule applies to UDP traffic only. When you use this keyword, the operator argument and the portgroup keyword are available, in addition to the keywords that are available for all valid values of the protocol argument.
|
source
|
Source IPv4 addresses that the rule matches. For details about the methods that you can use to specify this argument, see "Source and Destination" in the "Usage Guidelines" section.
|
destination
|
Destination IPv4 addresses that the rule matches. For details about the methods that you can use to specify this argument, see "Source and Destination" in the "Usage Guidelines" section.
|
dscp dscp
|
(Optional) Specifies that the rule matches only those packets with the specified 6-bit differentiated services value in the DSCP field of the IP header. The dscp argument can be one of the following numbers or keywords:
•0-63—The decimal equivalent of the 6 bits of the DSCP field. For example, if you specify 10, the rule matches only those packets that have the following bits in the DSCP field: 001010.
•af11—Assured Forwarding (AF) class 1, low drop probability (001010)
•af12—AF class 1, medium drop probability (001100)
•af13—AF class 1, high drop probability (001110)
•af21—AF class 2, low drop probability (010010)
•af22—AF class 2, medium drop probability (010100)
•af23—AF class 2, high drop probability (010110)
•af31—AF class 3, low drop probability (011010)
•af32—AF class 3, medium drop probability (011100)
•af33—AF class 3, high drop probability (011110)
•af41—AF class 4, low drop probability (100010)
•af42—AF class 4, medium drop probability (100100)
•af43—AF class 4, high drop probability (100110)
•cs1—Class-selector (CS) 1, precedence 1 (001000)
•cs2—CS2, precedence 2 (010000)
•cs3—CS3, precedence 3 (011000)
•cs4—CS4, precedence 4 (100000)
•cs5—CS5, precedence 5 (101000)
•cs6—CS6, precedence 6 (110000)
•cs7—CS7, precedence 7 (111000)
•default—Default DSCP value (000000)
•ef—Expedited Forwarding (101110)
|
precedence precedence
|
(Optional) Specifies that the rule matches only packets that have an IP Precedence field with the value specified by the precedence argument. The precedence argument can be a number or a keyword, as follows:
•0-7—Decimal equivalent of the 3 bits of the IP Precedence field. For example, if you specify 3, the rule matches only packets that have the following bits in the DSCP field: 011.
•critical—Precedence 5 (101)
•flash—Precedence 3 (011)
•flash-override—Precedence 4 (100)
•immediate—Precedence 2 (010)
•internet—Precedence 6 (110)
•network—Precedence 7 (111)
•priority—Precedence 1 (001)
•routine—Precedence 0 (000)
|
fragments
|
(Optional) Specifies that the rule matches only those packets that are noninitial fragments. You cannot specify this keyword in the same rule that you specify Layer 4 options, such as a TCP port number, because the information that the devices requires to evaluate those options is contained only in initial fragments.
|
log
|
(Optional) Specifies that the device generates an informational logging message about each packet that matches the rule. The message includes the following information:
•Whether the protocol was TCP, UDP, ICMP or a number
•Source and destination addresses
•Source and destination port numbers, if applicable
|
time-range time-range-name
|
(Optional) Specifies the time range that applies to this rule. You can configure a time range by using the time-range command. The time-range-name argument can be up to 64 alphanumeric, case-sensitive characters.
|
icmp-message
|
(ICMP only: Optional) ICMP message type that the rule matches. This argument can be an integer from 0 to 255 or one of the keywords listed under "ICMP Message Types" in the "Usage Guidelines" section.
|
igmp-message
|
(IGMP only: Optional) IGMP message type that the rule matches. The igmp-message argument can be the IGMP message number, which is an integer from 0 to 15. It can also be one of the following keywords:
•dvmrp—Distance Vector Multicast Routing Protocol
•host-query—Host query
•host-report—Host report
•pim—Protocol Independent Multicast
•trace—Multicast trace
|
operator port [port]
|
(Optional; TCP and UDP only) Rule matches only packets that are from a source port or sent to a destination port that satisfies the conditions of the operator and port arguments. Whether these arguments apply to a source port or a destination port depends upon whether you specify them after the source argument or after the destination argument.
The port argument can be the name or the number of a TCP or UDP port. Valid numbers are integers from 0 to 65535. For listings of valid port names, see "TCP Port Names" and "UDP Port Names" in the "Usage Guidelines" section.
A second port argument is required only when the operator argument is a range.
The operator argument must be one of the following keywords:
•eq—Matches only if the port in the packet is equal to the port argument.
•gt—Matches only if the port in the packet is greater than and not equal to the port argument.
•lt—Matches only if the port in the packet is less than and not equal to the port argument.
•neq—Matches only if the port in the packet is not equal to the port argument.
•range—Requires two port arguments and matches only if the port in the packet is equal to or greater than the first port argument and equal to or less than the second port argument.
|
portgroup portgroup
|
(Optional; TCP and UDP only) Specifies that the rule matches only packets that are from a source port or to a destination port that is a member of the IP port object group specified by the portgroup argument, which can be up to 64 alphanumeric, case-sensitive characters. Whether the IP port object group applies to a source port or a destination port depends upon whether you specify it after the source argument or after the destination argument.
Use the object-group ip port command to create and change IP port object groups.
|
flags
|
(TCP only; Optional) TCP control bit flags that the rule matches. The value of the flags argument must be one or more of the following keywords:
•ack
•fin
•psh
•rst
•syn
•urg
|
established
|
(TCP only; Optional) Specifies that the rule matches only packets that belong to an established TCP connection. The device considers TCP packets with the ACK or RST bits set to belong to an established connection.
|
Defaults
A newly created IPv4 ACL contains no rules.
If you do not specify a sequence number, the device assigns the rule a sequence number that is 10 greater than the last rule in the ACL.
Command Modes
IPv4 ACL configuration
Supported User Roles
network-admin
vdc-admin
Command History
Release
|
Modification
|
4.0(1)
|
This command was introduced.
|
Usage Guidelines
When the device applies an IPv4 ACL to a packet, it evaluates the packet with every rule in the ACL. The device enforces the first rule that has conditions that are satisfied by the packet. When the conditions of more than one rule are satisfied, the device enforces the rule with the lowest sequence number.
This command does not require a license.
Source and Destination
You can specify the source and destination arguments in one of several ways. In each rule, the method that you use to specify one of these arguments does not affect how you specify the other argument. When you configure a rule, use the following methods to specify the source and destination arguments:
•IP address group object—You can use an IPv4 address group object to specify a source or destination argument. Use the object-group ip address command to create and change IPv4 address group objects. The syntax is as follows:
addrgroup address-group-name
The following example shows how to use an IPv4 address object group named lab-gateway-svrs to specify the destination argument:
switch(config-acl)# deny ip any addrgroup lab-gateway-svrs
•Address and network wildcard—You can use an IPv4 address followed by a network wildcard to specify a host or a network as a source or destination. The syntax is as follows:
IPv4-address network-wildcard
The following example shows how to specify the source argument with the IPv4 address and network wildcard for the 192.168.67.0 subnet:
switch(config-acl)# deny tcp 192.168.67.0 0.0.0.255 any
•Address and variable-length subnet mask—You can use an IPv4 address followed by a variable-length subnet mask (VLSM) to specify a host or a network as a source or destination. The syntax is as follows:
The following example shows how to specify the source argument with the IPv4 address and VLSM for the 192.168.67.0 subnet:
switch(config-acl)# deny udp 192.168.67.0/24 any
•Host address—You can use the host keyword and an IPv4 address to specify a host as a source or destination. The syntax is as follows:
This syntax is equivalent to IPv4-address/32 and IPv4-address 0.0.0.0.
The following example shows how to specify the source argument with the host keyword and the 192.168.67.132 IPv4 address:
switch(config-acl)# deny icmp host 192.168.67.132 any
•Any address—You can use the any keyword to specify that a source or destination is any IPv4 address. For examples of the use of the any keyword, see the examples in this section. Each example shows how to specify a source or destination by using the any keyword.
ICMP Message Types
The icmp-message argument can be the ICMP message number, which is an integer from 0 to 255. It can also be one of the following keywords:
•administratively-prohibited—Administratively prohibited
•alternate-address—Alternate address
•conversion-error—Datagram conversion
•dod-host-prohibited—Host prohibited
•dod-net-prohibited—Net prohibited
•echo—Echo (ping)
•echo-reply—Echo reply
•general-parameter-problem—Parameter problem
•host-isolated—Host isolated
•host-precedence-unreachable—Host unreachable for precedence
•host-redirect—Host redirect
•host-tos-redirect—Host redirect for ToS
•host-tos-unreachable—Host unreachable for ToS
•host-unknown—Host unknown
•host-unreachable—Host unreachable
•information-reply—Information replies
•information-request—Information requests
•mask-reply—Mask replies
•mask-request—Mask requests
•mobile-redirect—Mobile host redirect
•net-redirect—Network redirect
•net-tos-redirect—Net redirect for ToS
•net-tos-unreachable—Network unreachable for ToS
•net-unreachable—Net unreachable
•network-unknown—Network unknown
•no-room-for-option—Parameter required but no room
•option-missing—Parameter required but not present
•packet-too-big—Fragmentation needed and DF set
•parameter-problem—All parameter problems
•port-unreachable—Port unreachable
•precedence-unreachable—Precedence cutoff
•protocol-unreachable—Protocol unreachable
•reassembly-timeout—Reassembly timeout
•redirect—All redirects
•router-advertisement—Router discovery advertisements
•router-solicitation—Router discovery solicitations
•source-quench—Source quenches
•source-route-failed—Source route failed
•time-exceeded—All time-exceeded messages
•timestamp-reply—Time-stamp replies
•timestamp-request—Time-stamp requests
•traceroute—Traceroute
•ttl-exceeded—TTL exceeded
•unreachable—All unreachables
TCP Port Names
When you specify the protocol argument as tcp, the port argument can be a TCP port number, which is an integer from 0 to 65535. It can also be one of the following keywords:
bgp—Border Gateway Protocol (179)
chargen—Character generator (19)
cmd—Remote commands (rcmd, 514)
daytime—Daytime (13)
discard—Discard (9)
domain—Domain Name Service (53)
drip—Dynamic Routing Information Protocol (3949)
echo—Echo (7)
exec—EXEC (rsh, 512)
finger—Finger (79)
ftp—File Transfer Protocol (21)
ftp-data—FTP data connections (2)
gopher—Gopher (7)
hostname—NIC hostname server (11)
ident—Ident Protocol (113)
irc—Internet Relay Chat (194)
klogin—Kerberos login (543)
kshell—Kerberos shell (544)
login—Login (rlogin, 513)
lpd—Printer service (515)
nntp—Network News Transport Protocol (119)
pim-auto-rp—PIM Auto-RP (496)
pop2—Post Office Protocol v2 (19)
pop3—Post Office Protocol v3 (11)
smtp—Simple Mail Transport Protocol (25)
sunrpc—Sun Remote Procedure Call (111)
tacacs—TAC Access Control System (49)
talk—Talk (517)
telnet—Telnet (23)
time—Time (37)
uucp—UNIX-to-UNIX Copy Program (54)
whois—WHOIS/NICNAME (43)
www—World Wide Web (HTTP, 8)
UDP Port Names
When you specify the protocol argument as udp, the port argument can be a UDP port number, which is an integer from 0 to 65535. It can also be one of the following keywords:
biff—Biff (mail notification, comsat, 512)
bootpc—Bootstrap Protocol (BOOTP) client (68)
bootps—Bootstrap Protocol (BOOTP) server (67)
discard—Discard (9)
dnsix—DNSIX security protocol auditing (195)
domain—Domain Name Service (DNS, 53)
echo—Echo (7)
isakmp—Internet Security Association and Key Management Protocol (5)
mobile-ip—Mobile IP registration (434)
nameserver—IEN116 name service (obsolete, 42)
netbios-dgm—NetBIOS datagram service (138)
netbios-ns—NetBIOS name service (137)
netbios-ss—NetBIOS session service (139)
non500-isakmp—Internet Security Association and Key Management Protocol (45)
ntp—Network Time Protocol (123)
pim-auto-rp—PIM Auto-RP (496)
rip—Routing Information Protocol (router, in.routed, 52)
snmp—Simple Network Management Protocol (161)
snmptrap—SNMP Traps (162)
sunrpc—Sun Remote Procedure Call (111)
syslog—System Logger (514)
tacacs—TAC Access Control System (49)
talk—Talk (517)
tftp—Trivial File Transfer Protocol (69)
time—Time (37)
who—Who service (rwho, 513)
xdmcp—X Display Manager Control Protocol (177)
Examples
This example shows how to configure an IPv4 ACL named acl-lab-01 with rules that deny all TCP and UDP traffic from the 10.23.0.0 and 192.168.37.0 networks to the 10.176.0.0 network and a final rule that permits all other IPv4 traffic:
switch(config)# ip access-list acl-lab-01
switch(config-acl)# deny tcp 10.23.0.0/16 10.176.0.0/16
switch(config-acl)# deny udp 10.23.0.0/16 10.176.0.0/16
switch(config-acl)# deny tcp 192.168.37.0/16 10.176.0.0/16
switch(config-acl)# deny udp 192.168.37.0/16 10.176.0.0/16
switch(config-acl)# permit ip any any
This example shows how to configure an IPv4 ACL named acl-eng-to-marketing with a rule that denies all IP traffic from an IPv4 address object group named eng_workstations to an IP address object group named marketing_group followed by a rule that permits all other IPv4 traffic:
switch(config)# ip access-list acl-eng-to-marketing
switch(config-acl)# deny ip addrgroup eng_workstations addrgroup marketing_group
switch(config-acl)# permit ip any any
Related Commands
Command
|
Description
|
ip access-list
|
Configures an IPv4 ACL.
|
object-group ip address
|
Configures an IPv4 address object group.
|
object-group ip port
|
Configures an IP port object group.
|
permit (IPv4)
|
Configures a permit rule in an IPv4 ACL.
|
remark
|
Configures a remark in an IPv4 ACL.
|
show ip access-list
|
Displays all IPv4 ACLs or one IPv4 ACL.
|
statistics per-entry
|
Enables collection of statistics for each entry in an ACL.
|
time-range
|
Configures a time range.
|
deny (MAC)
To create a MAC access control list (ACL)+ rule that denies traffic matching its conditions, use the deny command. To remove a rule, use the no form of this command.
[sequence-number] deny source destination [protocol] [cos cos-value] [vlan VLAN-ID]
no deny source destination [protocol] [cos cos-value] [vlan VLAN-ID]
no sequence-number
Syntax Description
sequence-number
|
(Optional) Sequence number of the deny command, which causes the device to insert the command in that numbered position in the access list. Sequence numbers maintain the order of rules within an ACL.
A sequence number can be any integer between 1 and 4294967295.
By default, the first rule in an ACL has a sequence number of 10.
If you do not specify a sequence number, the device adds the rule to the end of the ACL and assigns a sequence number that is 10 greater than the sequence number of the preceding rule.
Use the resequence command to reassign sequence numbers to rules.
|
source
|
Source MAC addresses that the rule matches. For details about the methods that you can use to specify this argument, see "Source and Destination" in the "Usage Guidelines" section.
|
destination
|
Destination MAC addresses that the rule matches. For details about the methods that you can use to specify this argument, see "Source and Destination" in the "Usage Guidelines" section.
|
protocol
|
(Optional) Protocol number that the rule matches. Valid protocol numbers are 0x0 to 0xffff. For listings of valid protocol names, see "MAC Protocols" in the "Usage Guidelines" section.
|
cos cos-value
|
(Optional) Specifies that the rule matches only packets with an IEEE 802.1Q header that contains the Class of Service (CoS) value given in the cos-value argument. The cos-value argument can be an integer from 0 to 7.
|
vlan VLAN-ID
|
(Optional) Specifies that the rule matches only packets with an IEEE 802.1Q header that contains the VLAN ID given. The VLAN-ID argument can be an integer from 1 to 4094.
|
Defaults
A newly created MAC ACL contains no rules.
If you do not specify a sequence number, the device assigns the rule a sequence number that is 10 greater than the last rule in the ACL.
Command Modes
MAC ACL configuration
Supported User Roles
network-admin
vdc-admin
Command History
Release
|
Modification
|
4.0(1)
|
This command was introduced.
|
Usage Guidelines
When the device applies a MAC ACL to a packet, it evaluates the packet with every rule in the ACL. The device enforces the first rule that has conditions that are satisfied by the packet. When the conditions of more than one rule are satisfied, the device enforces the rule with the lowest sequence number.
This command does not require a license.
Source and Destination
You can specify the source and destination arguments in one of two ways. In each rule, the method that you use to specify one of these arguments does not affect how you specify the other argument. When you configure a rule, use the following methods to specify the source and destination arguments:
•Address and mask—You can use a MAC address followed by a mask to specify a single address or a group of addresses. The syntax is as follows:
The following example specifies the source argument with the MAC address 00c0.4f03.0a72:
switch(config-acl)# deny 00c0.4f03.0a72 0000.0000.0000 any
The following example specifies the destination argument with a MAC address for all hosts with a MAC vendor code of 00603e:
switch(config-acl)# deny any 0060.3e00.0000 0000.0000.0000
•Any address—You can use the any keyword to specify that a source or destination is any MAC address. For examples of the use of the any keyword, see the examples in this section. Each of the examples shows how to specify a source or destination by using the any keyword.
MAC Protocols
The protocol argument can be the MAC protocol number or a keyword. The protocol number is a four-byte hexadecimal number prefixed with 0x. Valid protocol numbers are from 0x0 to 0xffff. Valid keywords are the following:
•aarp—Appletalk ARP (0x80f3)
•appletalk—Appletalk (0x809b)
•decnet-iv—DECnet Phase IV (0x6003)
•diagnostic—DEC Diagnostic Protocol (0x6005)
•etype-6000—EtherType 0x6000 (0x6000)
•etype-8042—EtherType 0x8042 (0x8042)
•ip—Internet Protocol v4 (0x0800)
•lat—DEC LAT (0x6004)
•lavc-sca—DEC LAVC, SCA (0x6007)
•mop-console—DEC MOP Remote console (0x6002)
•mop-dump—DEC MOP dump (0x6001)
•vines-echo—VINES Echo (0x0baf)
Examples
This example shows how to configure a MAC ACL named mac-ip-filter with rules that permit any non-IPv4 traffic between two groups of MAC addresses:
switch(config)# mac access-list mac-ip-filter
switch(config-mac-acl)# deny 00c0.4f00.0000 0000.00ff.ffff 0060.3e00.0000 0000.00ff.ffff
ip
switch(config-mac-acl)# permit any any
Related Commands
Command
|
Description
|
mac access-list
|
Configures a MAC ACL.
|
permit (MAC)
|
Configures a deny rule in a MAC ACL.
|
remark
|
Configures a remark in an ACL.
|
show mac access-list
|
Displays all MAC ACLs or one MAC ACL.
|
statistics per-entry
|
Enables collection of statistics for each entry in an ACL.
|
deny (role-based access control list)
To configure a deny action in the security group access control list (SGACL), use the deny command. To remove the action, use the no form of this command.
deny {all | icmp | igmp | ip | {{tcp | udp} [{src | dest} {{eq | gt | lt | neq} port-number} |
range port-number1 port-number2}]}
no deny {all | icmp | igmp | ip | {{tcp | udp} [{src | dest} {{eq | gt | lt | neq} port-number} |
range port-number1 port-number2}]}
Syntax Description
all
|
Specifies all traffic.
|
icmp
|
Specifies Internet Control Message Protocol (ICMP) traffic.
|
igmp
|
Specifies Internet Group Management Protocol (IGMP) traffic.
|
ip
|
Specifies IP traffic.
|
tcp
|
Specifies TCP traffic.
|
udp
|
Specifies User Datagram Protocol (UDP) traffic.
|
src
|
Specifies the source port number.
|
dest
|
Specifies the destination port number
|
eq
|
Specifies equal to the port number.
|
gt
|
Specifies greater than the port number.
|
lt
|
Specifies less than the port number.
|
neq
|
Specifies not equal to the port number.
|
port-number
|
Port number for TCP or UDP. The range is from 0 to 65535.
|
range
|
Specifies a port range for TCP or UDP.
|
port-number1
|
First port in the range. The range is from 0 to 65535.
|
port-number2
|
Last port in the range. The range is from 0 to 65535.
|
Defaults
None
