Administrator Guide
The access-group option pertains to:
● IP protocol number: from 0 to 255
● Internet control message protocol (icmp) but not the ICMP message type (from 0 to 255)
● Any internet protocol (ip)
● Transmission Control Protocol (tcp) but not on the rst, syn, or urg bits
● User Datagram Protocol (udp)
If an ambiguous access control list rules, the debug ip packet access-control command is
disabled. A message appears identifying the error (refer to the following Example).
Example (Error
Messages)
Dell#debug ip packet access-group test
%Error: port operator GT not supported in access-list debug
%Error: port operator LT not supported in access-list debug
%Error: port operator RANGE not supported in access-list debug
%Error: port operator NEQ not supported in access-list debug
Dell#00:10:45: %RPM0-P:CP
%IPMGR-3-DEBUG_IP_PACKET_ACL_AMBIGUOUS_EXP: Ambiguous rules not
supported in access-list debug, access-list debugging is turned off
Dell#
deny arp (for Extended MAC ACLs)
Configure an egress filter that drops ARP packets on egress ACL supported line cards. (For more information, refer to your line
card documentation).
C9000 Series
Syntax
deny arp {destination-mac-address mac-address-mask | any} vlan vlan-id {ip-
address | any | opcode code-number} [count [byte]] [order] [log [interval
minutes] [threshold-in-msgs [count]] [monitor]
To remove this filter, you have two choices:
● Use the no seq sequence-number command if you know the filter’s sequence number.
● Use the no deny arp {destination-mac-address mac-address-mask | any} vlan
vlan-id {ip-address | any | opcode code-number} command.
Parameters
log (OPTIONAL) Enter the keyword log to enable the triggering of ACL log messages.
threshold-in
msgs
count
(OPTIONAL) Enter the threshold-in-msgs keyword followed by a value to
indicate the maximum number of ACL logs that can be generated, exceeding which
the generation of ACL logs is terminated with the seq, permit, or deny
commands. The threshold range is from 1 to 100.
interval
minutes
(OPTIONAL) Enter the keyword interval followed by the time period in minutes
at which ACL logs must be generated. The time interval range is from 1 to 10
minutes.
monitor (OPTIONAL) Enter the keyword monitor when the rule is describing the traffic
that you want to monitor and the ACL in which you are creating the rule is applied
to the monitored interface.
Command Modes CONFIGURATION-EXTENDED-ACCESS-LIST
Command
History
Version Description
9.9(0.0) Introduced on the C9010.
9.5(0.1) Introduced on the Z9500.
IPv4 Routing 915