Cisco Catalyst 2950 Command Reference Manual page 113

Chapter 2 Catalyst 2950 and 2955 Cisco IOS Commands
operator port
dscp dscp-value
time-range
time-range-name
Defaults There are no specific conditions that deny packets in the named or numbered IP ACL.
The default ACL is always terminated by an implicit deny statement for all packets.
Command Modes Access-list configuration
Command History Release
12.1(6)EA2
Usage Guidelines Use this command after the ip access-list global configuration command to specify deny conditions for
an IP ACL. You can specify a source IP address, destination IP address, IP protocol, TCP port, or UDP
port. Specify the TCP and UDP port numbers only if protocol is tcp or udp and operator is eq.
For more information about configuring IP ACLs, see the "Configuring Network Security with ACLs"
Note
chapter in the software configuration guide for this release.
Examples
This example shows how to create an extended IP ACL and to configure deny conditions for it:
Switch(config)# ip access-list extended Internetfilter
Switch(config-ext-nacl)# deny tcp host 190.5.88.10 any
Switch(config-ext-nacl)# deny tcp host 192.1.10.10 any
OL-10102-01
(Optional) Define a source or destination port.
The operator can be only eq (equal).
If operator is after the source IP address and wildcard, conditions match
when the source port matches the defined port.
If operator is after the destination IP address and wildcard, conditions
match when the destination port matches the defined port.
The port is a decimal number or name of a TCP or User Datagram
Protocol (UDP) port. The number can be from 0 to 65535.
Use TCP port names only for TCP traffic.
Use UDP port names only for UDP traffic.
(Optional) Define a Differentiated Services Code Point (DSCP) value to
classify traffic.
For the dscp-value, enter any of the 13 supported DSCP values (0, 8, 10,
16, 18, 24, 26, 32, 34, 40, 46, 48, and 56), or use the question mark (?) to
see a list of available values.
(Optional) For the time-range keyword, enter a meaningful name to
identify the time range. For a more detailed explanation of this keyword,
see the software configuration guide.
Modification
This command was introduced.
Catalyst 2950 and Catalyst 2955 Switch Command Reference
deny (access-list configuration)
2-83