Reference Guide

Access Control Lists (ACL) | 193
deny tcp
c e s z
Configure a filter that drops TCP packets meeting the filter criteria.
Syntax
deny tcp {source mask | any | host ip-address} [bit] [operator port [port]] {destination mask |
any | host ip-address} [dscp] [bit] [operator port [port]] [count [byte] | log] [order] [monitor]
[fragments]
To remove this filter, you have two choices:
• Use the no seq sequence-number command syntax if you know the filter’s sequence number or
• Use the no deny tcp {source mask | any | host ip-address} {destination mask | any | host
ip-address} command.
Parameters
ttl-exceeded TTL exceeded
unreachable All unreachables
Table 6-2. ICMP Message Type Keywords
Keyword ICMP Message Type Name
source
Enter the IP address of the network or host from which the packets were sent.
mask
Enter a network mask in /prefix format (/x) or A.B.C.D. The mask, when
specified in A.B.C.D format, may be either contiguous or non-contiguous.
any Enter the keyword any to specify that all routes are subject to the filter.
host ip-address Enter the keyword host followed by the IP address to specify a host IP
address.
dscp
Enter this keyword to deny a packet based on DSCP value.
Range: 0-63
bit
Enter a flag or combination of bits:
ack: acknowledgement field
fin: finish (no more data from the user)
psh: push function
rst: reset the connection
syn: synchronize sequence numbers
urg: urgent field
operator
(OPTIONAL) Enter one of the following logical operand:
•
eq = equal to
•
neq = not equal to
•
gt = greater than
•
lt = less than
•
range = inclusive range of ports (you must specify two ports for the port
command parameter.