Cisco Nexus 5500 Series - Page 58

44
Cisco Nexus 5500 Series NX-OS Security Command Reference
OL-27883-02
Chapter D Commands
deny icmp (IPv4)
• host-unknown—Host unknown
• host-unreachable—Host unreachable
• information-reply—Information replies
• information-request—Information requests
• mask-reply—Mask replies
• mask-request—Mask requests
• mobile-redirect—Mobile host redirect
• net-redirect—Network redirect
• net-tos-redirect—Net redirect for ToS
• net-tos-unreachable—Network unreachable for ToS
• net-unreachable—Net unreachable
• network-unknown—Network unknown
• no-room-for-option—Parameter required but no room
• option-missing—Parameter required but not present
• packet-too-big—Fragmentation needed and DF set
• parameter-problem—All parameter problems
• port-unreachable—Port unreachable
• precedence-unreachable—Precedence cutoff
• protocol-unreachable—Protocol unreachable
• reassembly-timeout—Reassembly timeout
• redirect—All redirects
• router-advertisement—Router discovery advertisements
• router-solicitation—Router discovery solicitations
• source-quench—Source quenches
• source-route-failed—Source route failed
• time-exceeded—All time-exceeded messages
• timestamp-reply—Time-stamp replies
• timestamp-request—Time-stamp requests
• traceroute—Traceroute
• ttl-exceeded—TTL exceeded
• unreachable—All unreachables
Examples This example shows how to configure an IPv4 ACL named acl-lab-01 with rules that deny all ICMP
traffic from the 10.23.0.0 and 192.168.37.0 networks to the 10.176.0.0 network and a final rule that
permits all other IPv4 traffic:
switch(config)# ip access-list acl-lab-01
switch(config-acl)# deny icmp 10.23.0.0/16 10.176.0.0/16
switch(config-acl)# deny icmp 192.168.37.0/16 10.176.0.0/16
switch(config-acl)# permit ip any any