deny

Adds a filter condition to an access list.

deny <protocol> 
 
     {<src> <wildcard> | host <src-addr> | any} 
 
     {<dest> <wildcard> | host <dest-addr> | any}
 

 
deny icmp
 
     {<src> <wildcard> | host <src-addr> | any} 
 
     {<dest> <wildcard> | host <dest-addr> | any}
 
     [<icmp-type> [<icmp-code>]]
 

 
deny tcp
 
     {<src> <wildcard> | host <src-addr> | any} 
 
     [<operator> <port> | range <port1> <port2>] 
 
     {<dest> <wildcard> | host <dest-addr> | any}
 
     [<operator> <port> | range <port1> <port2>]
 
     [established | syn]
 

 
deny udp
 
     {<src> <wildcard> | host <src-addr> | any} 
 
     [<operator> <port> | range <port1> <port2>] 
 
     {<dest> <wildcard> | host <dest-addr> | any}
 
     [<operator> <port> | range <port1> <port2>]
 

 

no deny <protocol> <source> <source-wildcard> <dest> <dest-wildcard>
 

 
no deny icmp <src> <src-wildcard> <dest> <dest-wildcard> [<icmp-type> [<icmp-code>]
 

 

no deny tcp
 
        {<src> <wildcard> | host <src-addr> | any}
 
        [<operator> <port> | range <port1> <port2>]
 
        {<dest> <wildcard> | host <dest-addr> | any}
 
        [<operator> <port> | range <port1> <port2>] [established | syn]
 

 
no deny udp
 
        {<src> <wildcard> | host <src-addr> | any}
 
        [<operator> <port>|range<port1> <-port2>]
 
        {<dest> <wildcard> | host <dest-addr> | any}
 
        [<operator> <port> | range <port1> <port2>]
 

• protocol--protocol name, or integer in the range 0 through 255, representing an IP protocol number
• src--IP address in dotted decimal format (a.b.c.d); source of packet
• wildcard--wildcard bits; dotted-decimal mask
• src-addr--IP address in dotted decimal format (a.b.c.d)
• dest--IP address in dotted-decimal format (a.b.c.d);destination of packet
• dest-addr--IP address in dotted-decimal format (ab.c.d)
• icmp-type--integer, in the range 0 through 255; ICMP message type
• icmp-code--integer, in the range 0 through 255; ICMP message code
• operator--can be one of the following string values:
• eq--equal to
• lt--less than
• gt--greater than
• neq--not equal to
• port--access port
• port1--low-end of range of ports
• port2--high-end of range of ports

Access list configuration mode (config-acl), which requires privileged-level access.

Available for use multiple times in the configuration.

IP protocol names and numbers are defined in RFC 1700.

The no form of the command deletes the matching element from the access list.

The established keyword indicates an established connection (ACK or RST bits must be set).

The syn keyword means no established connection (will match packets with the SYN bit set and the ACK and FIN bits cleared, which indicates a request to initiate a TCP connection).

The src and dest addresses are paired with wildcard masks; the src-host-address and dest-host-address values are complete IP addresses (with an implied mask of 0.0.0.0).

If you get an insufficient or bad arguments error message when you apply the access list to an interface, there may be a mismatch between IP address and wildcard mask in one of the rules. See Wildcard Masks in Chapter 3: Security of the CNA Basic Monitoring Guide.

If you add a malformed rule to an existing access list that is already applied to an interface, you may see the insufficient or bad arguments message whenever you attempt to execute any command related to the interface. To recover from this condition, remove the offending rule from the access list and re-enter the IP address and mask correctly.

See the permit command.