-
Catalyst 2948G-L3 and Catalyst 4908G-L3 Software Feature and Configuration Guide IOS Software, Release 12.0(10)W5(18e)
-
Preface
-
Overview of Layer 3 Switching and Software Features
-
Before You Begin
-
Initial Switch Router Configurations
-
Configuring Interfaces
-
Configuring Virtual LAN Encapsulation
-
Configuring Networking Protocols
-
Configuring Bridging
-
Configuring Etherchannel
-
Configuring Quality of Service
-
Configuring Switching Database Manager
-
Configuring Access Control Lists
-
Command Reference
-
Error Messages
-
Configuration Examples
-
Cisco IOS Commands Not Supported in Layer 3 Switching Software
-
Using Technical Support
-
Feedback
Table Of Contents
Command Reference
This appendix provides a command reference for those Cisco IOS commands—or aspects of the commands—that are unique to Layer 3 switching. This appendix contains the following commands:
QoS Commands
qos switching
Use the qos switching command to enable quality of service (QoS) mapping on the device.
qos switching
Syntax Description
This command has no keywords or arguments.
Defaults
QoS mapping is enabled.
Command Modes
Device configuration
Examples
The following example shows how to enable QoS mapping using the qos switching configuration command:
Router# qos switchingRelated CommandsRelated Command
qos mapping precedence
Use the qos mapping precedence command to configure QoS mapping at the system or interface level. Use the no form of this command to set the QoS precedence back to the default value.
qos mapping [source source-int] [destination dest-int] precedence value wrr-weight weight
no qos mapping precedence
Syntax Description
Defaults
The default WRR-weights for precedence values 0, 1, 2, 3 are 1, 2, 3, and 4, respectively.
Command Modes
Device configuration
Usage Guidelines
When a precedence value n is specified, it implicitly assigns the same WRR weight to the precedence n + 1.
Examples
The following example shows how to set the system-level QoS mapping using the
qos mapping precedence configuration command:Router(config)# qos mapping precedence 0 wrr-weight 4Related CommandsRelated Command
rate-limit
Use the rate-limit command to configure QoS rate limits on a per-physical port basis.
rate-limit input {32000-100000000} {0-64000}
rate-limit output {32000-100000000} {0-64000}
Syntax Description
input
Keyword that specifies limiting the input rate.
32000-100000000
Target bit rate in bits per second.
0-64000
Burst size in bytes.
output
Keyword that specifies limiting the output rate.
Command Modes
Device configuration
Usage Guidelines
Rate limiting is applied to the entire interface traffic and is not confined to IP layer3 traffic only. However, high priority traffic destined to the CPU, traffic originating from the CPU or traffic which is process switched by the CPU is not subjected to per-port rate limiting.
Examples
The following example shows how to configure input rate limiting with a target bit rate of 1000000 bits per second and a burst size of 1000:
Router(config-if)# rate-limit input 1000000 1000Router(config-if)#The following example shows how to configure output rate limiting with a target bit rate of 1000000 bits per second and a burst size of 1000:
Router(config-if)# rate-limit output 1000000 1000Router(config-if)#Related Commands
show run interface
show qos switching
Use the show qos switching command to show whether QoS mapping is enabled on the device.
show qos switching
Syntax Description
This command has no keywords or arguments.
Command Modes
Privileged EXEC
Examples
The following example shows how to display whether QoS mapping is enabled using the show qos switching command:
Router# show qos switchingQoS Based IP Switching enabledRelated CommandsRelated Command
show qos mapping
Use the show qos mapping command to show the QoS mapping in effect at the system or destination interface level.
show qos mapping [source source-int] [destination dest-int]
Syntax Description
Command Modes
Privileged EXEC
Examples
The following example shows how to display the system-level QoS mapping using the show qos mapping command:
Router# show qos mappingPrecedence WRR-Weight0 11 22 33 4Related CommandsRelated Command
traffic-shape rate
Use the traffic-shape rate command to configure QoS traffic shaping at the interface level.
traffic-shape rate {32000-100000000} {0-512000}
Syntax Description
Command Modes
Device configuration
Usage Guidelines
Shaping is applied to the entire interface output traffic and is not confined to IP layer3 traffic only. However, traffic originating from the CPU or process switched by the CPU is not subjected to per-port shaping.
Examples
The following example shows how to configure traffic shaping with a target bit rate of 1000000 bits per second and a burst size of 1000:
Router(config-if)# traffic-shape rate 1000000 1000Related Commands
show run interface
SDM Commands
sdm access-list
Use the sdm access-list command to partition the ternary content addressable memory (TCAM) space for the access list region.
sdm access-list num-entries
Syntax Description
Command Modes
Global configuration
Usage Guidelines
The enhanced Gigabit Ethernet interface module supports TCAM sizes of 32K. The combined size of the protocol regions and access lists should not exceed your TCAM space. The default size of the access lists in a 32K TCAM is 512 entries. You can enter the sdm access-list command to partition the TCAM space for access lists.
Examples
The following example shows how to partition the TCAM space to 600 entries:
Router(config-if)# sdm access-list 600Router(config-if)#Related Commands
sdm autolearn
Use the sdm autolearn command to enable the Switching Database Manager (SDM) autolearn feature. Use the no form of this command to disable it.
sdm autolearn
no sdm autolearn
Syntax Description
This command has no keywords or arguments.
Defaults
SDM autolearn is enabled.
Command Modes
Global configuration
Usage Guidelines
When the SDM autolearn feature is enabled, SDM automatically saves mask-length distribution for the routing database. SDM then uses this mask-length distribution as the initial mask-length distribution, which takes effect during the next system reboot.
Examples
The following example shows how to enable autolearning on the SDM:
Router(config-if)# sdm autolearnRouter(config-if)#sdm size
Use the sdm size command to configure the size of each protocol region in the SDM.
sdm size region-name {num-entries | k-entries num-k-entries}
Syntax Description
Command Modes
Global configuration
Usage Guidelines
The combined size entered for all the protocol regions should not exceed 32K, which is the total TCAM size. The supported size can be displayed using the show sdm size command. The size of SDM is represented as the number of base entries. Each protocol region entry can occupy one or more TCAM entries. The combined size of all the protocol regions should be calculated in terms of the base entries. Table A-1 lists the number of TCAM entries needed for each protocol region.
Because the ip-prefix region occupies one TCAM entry, the sdm size ip-prefix k-entries 6 command configures 6K TCAM entries in the SDM for the ip-prefix region. Because each ipx-node entry occupies two TCAM entries, the sdm size ipx-node k-entries 3 command configures 6K TCAM entries in the SDM for the ipx-node region.
Examples
The following example shows how to set the region to ipx-node and the number of entries to 32:
Router(config-if)# sdm size ipx-node 32Router(config-if)#Related CommandsRelated Command
show sdm size
Use the show sdm size command to display the TCAM size and the size of each protocol region. The size is shown as the number of entries.
show sdm size
Syntax Description
This command has no keywords or arguments.
Command Modes
Privileged EXEC
Examples
The following example shows how to display the show sdm size command output:
Router# show sdm sizeSwitching Database Region Sizes :IPX BVI Network : 32 32-bit entriesIP Adjacency : 2048 32-bit entriesIPX Node : 2048 64-bit entriesIP Prefix : 8192 32-bit entriesIPX Network : 6144 32-bit entriesIP Multicast : 3072 64-bit entriesMAC Addr : 1024 64-bit entriesAccess List : 512 128-bit entriesRelated CommandsRelated Command
IP Uplink Redirect Commands
ip uplink-redirect
Use the ip uplink-redirect command to enable the IP uplink redirect feature. Use the no form of this command to disable it.
ip uplink-redirect
Syntax Description
This command has no keywords or arguments.
Defaults
Show ip uplink-redirect is disabled.
Command Modes
Global configuration
Usage Guidelines
The IP uplink redirect feature is supported on the Catalyst 2948G-L3 only. IP uplink redirect enables traffic between Fast Ethernet interfaces to be switched through the Gigabit Ethernet interface. ACLs applied on the Gigabit Ethernet filter traffic switched between Fast Ethernet interfaces.
The network processor on the Fast Ethernet interface does not switch certain IP packets, for instance IP packets with options, which are CPU process switched. The CPU switches the packets based on the IOS routing table. When the redirect feature is enabled, the network processor switched packets and the CPU process switched packets between two hosts connected to different Fast Ethernet interfaces will take different paths. ACLs can block traffic between two Fast Ethernet interfaces allowing IP packets with options to go through because the packets will be routed by the CPU process and not redirected to the Gigabit Ethernet interface.
CautionIf the upstream router has an alternate better path (than the path used by the
Gigabit Ethernet interface) to the Fast Ethernet interfaces of the Catalyst 2948G-L3 switch router, it could result in routing loops.
Examples
The following example shows how to enable IP uplink redirect:
Router(config-if)# ip uplink redirectRouter(config-if)#Related Commands
show ip uplink-redirect
Use the show ip uplink-redirect command to display the running IP uplink redirect configuration.
show ip uplink-redirect
Syntax Description
This command has no keywords or arguments.
Command Modes
Privileged EXEC
Examples
The following is sample output from the show ip uplink-redirect command:
Router# show ip uplink-redirectIP Uplink Redirect Configuration:Running Configuration :no ip uplink-redirectConfiguration on next reload :ip uplink-redirectRouter#Related Commands
IP Services Commands
access-list (IP standard)
Use the standard version of the access-list global configuration command to define a standard IP ACL. Use the no form of this command to remove a standard ACLs.
access-list access-list-number {deny | permit} source [source-wildcard]
no access-list access-list-number
Syntax Description
Defaults
The ACL defaults to an implicit deny statement for everything. The ACL is always terminated by an implicit deny statement for everything.
Command Modes
Global configuration
Usage Guidelines
Plan your access conditions carefully and be aware of the implicit deny statement at the end of the ACL.
You can use ACLs to control the transmission of packets on an interface, control virtual terminal line access, and restrict the contents of routing updates.
Use the show access-lists EXEC command to display the contents of all ACLs.
Use the show ip access-list EXEC command to display the contents of one ACL.
Examples
The following example of a standard ACL allows access for only those hosts on the three specified networks. The wildcard bits apply to the host portions of the network addresses. Any host with a source address that does not match the ACL statements will be rejected.
Router(config)# access-list 1 permit 192.5.34.0 0.0.0.255Router(config)# access-list 1 permit 128.88.0.0 0.0.255.255Router(config)# access-list 1 permit 36.0.0.0 0.255.255.255! (Note:all other access implicitly denied)To specify a large number of individual addresses more easily, you can omit the wildcard if it is all zeros. The following two configuration commands are identical in effect:
Router(config)# access-list 2 permit 36.48.0.3Router(config)# access-list 2 permit 36.48.0.3 0.0.0.0Related Commands
access-list (IP extended)
Use the extended version of the access-list global configuration command to define an extended IP access list. Use the no form of this command to remove the access lists.
access-list access-list-number {deny | permit} protocol source source-wildcard destination destination-wildcard [precedence precedence] [tos tos]
no access-list access-list-number
Internet Control Message Protocol (ICMP)
access-list access-list-number {deny | permit} icmp source source-wildcard destination destination-wildcard [icmp-type [icmp-code] | icmp-message] [precedence precedence]
[tos tos]Internet Group Management Protocol (IGMP)
access-list access-list-number {deny | permit} igmp source source-wildcard destination destination-wildcard [igmp-type] [precedence precedence] [tos tos]
TCP
access-list access-list-number {deny | permit} tcp source source-wildcard [operator port [port]] destination destination-wildcard [operator port [port]] [precedence precedence] [tos tos]
User Datagram Protocol (UDP)
access-list access-list-number {deny | permit} udp source source-wildcard [operator port [port]] destination destination-wildcard [operator port [port]] [precedence precedence] [tos tos]
Syntax Description
Defaults
An extended access list defaults to a list that denies everything. An extended access list is terminated by an implicit deny statement.
Command Modes
Global configuration
Usage Guidelines
Fragmented IP packets, other than the initial fragment, are immediately accepted by any extended IP access list. Extended access lists used to restrict contents of routing updates must not match against the TCP source port, the type of service value, or the packet's precedence.
Note
The following is a list of precedence names:
•
•
•
•
•
•
•
•
The following is a list of type of service (ToS) names:
•
•
•
•
•
The following is a list of ICMP message type names and ICMP message type and code names:
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
The following is a list of IGMP message names:
•
•
•
•
•
The following is a list of TCP port names that can be used instead of port numbers. Refer to the current Assigned Numbers RFC to find a reference to these protocols. Port numbers corresponding to these protocols can also be found by typing a ? in the place of a port number.
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
The following is a list of UDP port names that can be used instead of port numbers. Refer to the current Assigned Numbers RFC to find a reference to these protocols. Port numbers corresponding to these protocols can also be found by typing a ? in the place of a port number.
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
Examples
In the following example, serial interface 0 is part of a Class B network with the address 128.88.0.0, and the mail host's address is 128.88.1.2. The keyword established is used only for the TCP protocol to indicate an established connection. A match occurs if the TCP datagram has the ACK or RST bits set, which indicate that the packet belongs to an existing connection.
Router(config)# access-list 102 permit tcp 0.0.0.0 255.255.255.255 128.88.0.0 0.0.255.255 establishedRouter(config)# access-list 102 permit tcp 0.0.0.0 255.255.255.255 128.88.1.2 0.0.0.0 eq 25Router(config)# interface serial 0Router(config)# ip access-group 102 inThe following example also permit Domain Naming System (DNS) packets and ICMP echo and echo reply packets:
Router(config)# access-list 102 permit tcp any 128.88.0.0 0.0.255.255 establishedRouter(config)# access-list 102 permit tcp any host 128.88.1.2 eq smtpRouter(config)# access-list 102 permit tcp any any eq domainRouter(config)# access-list 102 permit udp any any eq domainRouter(config)# access-list 102 permit icmp any any echoRouter(config)# access-list 102 permit icmp any any echo-replyThe following examples show how wildcard bits are used to indicate the bits of the prefix or mask that are relevant. They are similar to the bitmasks that are used with normal access lists. Prefix/mask bits corresponding to wildcard bits set to 1 are ignored during comparisons and prefix/mask bits corresponding to wildcard bits set to 0 are used in comparison.
The following example shows how to permit 192.108.0.0 255.255.0.0 but deny any more specific routes of 192.108.0.0 (including 192.108.0.0 255.255.255.0).
Router(config)# access-list 101 permit ip 192.108.0.0 0.0.0.0 255.255.0.0 0.0.0.0Router(config)# access-list 101 deny ip 192.108.0.0 0.0.255.255 255.255.0.0 0.0.255.255The following example shows how to permit 131.108.0/24 but deny 131.108/16 and all other subnets of 131.108.0.0.
Router(config)# access-list 101 permit ip 131.108.0.0 0.0.0.0 255.255.255.0 0.0.0.0Router(config)# access-list 101 deny ip 131.108.0.0 0.0.255.255 255.255.0.0 0.0.255.255Related Commands
deny (IP)
Use the deny access-list configuration command to set conditions for a named IP access list. Use the no form of this command to remove a deny condition from an access list.
deny {source [source-wildcard] | any}
no deny {source [source-wildcard] | any}
deny protocol source source-wildcard destination destination-wildcard [precedence precedence]
[tos tos]no deny protocol source source-wildcard destination destination-wildcard
ICMP
deny icmp source source-wildcard destination destination-wildcard [icmp-type [icmp-code] | icmp-message] [precedence precedence] [tos tos]
IGMP
deny igmp source source-wildcard destination destination-wildcard [igmp-type] [precedence precedence] [tos tos]
TCP
deny tcp source source-wildcard [operator port [port]] destination destination-wildcard
[operator port [port]] [precedence precedence] [tos tos]UDP
deny udp source source-wildcard [operator port [port]] destination destination-wildcard
[operator port [port]] [precedence precedence] [tos tos]Syntax Description
Defaults
There is no specific condition under which a packet is denied passing the named access list.
Command Modes
Access-list configuration
Usage Guidelines
Use this command following the ip access-list command to specify conditions under which a packet cannot pass the named access list.
Examples
The following example sets a deny condition for a standard access list named Internetfilter:
Router(config)# ip access-list standard InternetfilterRouter(config)# deny 192.5.34.0 0.0.0.255Router(config)# permit 128.88.0.0 0.0.255.255Router(config)# permit 36.0.0.0 0.255.255.255! (Note: all other access implicitly denied)Related Commands
ip access-group
Use the ip access-group interface configuration command to control access to an interface. Use the no form of this command to remove the specified access group.
ip access-group {access-list-number | name}{in | out}
no ip access-group {access-list-number | name}{in | out}
Syntax Description
Defaults
No access list is applied to the interface.
Command Modes
Interface configuration
Usage Guidelines
For inbound ACLs, after receiving a packet, the microcode performs a source address lookup at the start of the ACL or a 5 tuple for an extended ACL in the TCAM containing the ACE's. If the ACL permits the address, the software continues to process the packet. If the ACL rejects the address, the software discards the packet.
For outbound ACLs, after receiving and routing a packet to a controlled interface, the microcode performs a source address lookup in a standard IP ACL or a 5 tuple lookup in an extended IP ACL in the TCAM containing ACE's. If the ACL permits the address, the software transmits the packet. If the ACL rejects the address, the software discards the packet.
When you apply an ACL that has not yet been defined to an interface, the software will act as if the ACL has not been applied to the interface and will accept all packets. Remember this behavior if you use undefined ACLs as a means of security in your network.
Note
Examples
The following example applies list 101 on packets outbound from Ethernet interface 0:
Router(config)# interface ethernet 0Router(config)# ip access-group 101 outRelated Commands
ip access-list
Use the ip access-list global configuration command to define an IP access list by name. Use the no form of this command to remove a named IP access lists.
ip access-list {standard | extended} name
no ip access-list {standard | extended} name
Syntax Description
Defaults
No named IP access list is defined.
Command Modes
Global configuration
Usage Guidelines
Use this command to configure a named IP access list as opposed to a numbered IP access list. This command will take you into access-list configuration mode, where you must define the denied or permitted access conditions with the deny and permit commands.
Specifying standard or extended with the ip access-list command determines the prompt you get when you enter access-list configuration mode.
Use the ip access-group command to apply the access-list to an interface.
Examples
The following example defines a standard access list named Internetfilter:
Router(config)# ip access-list standard InternetfilterRouter(config)# permit 192.5.34.0 0.0.0.255Router(config)# permit 128.88.0.0 0.0.255.255Router(config)# permit 36.0.0.0 0.255.255.255! (Note: all other access implicitly denied)Related Commands
permit (IP)
Use the permit access-list configuration command to set conditions for a named IP access list. Use the no form of this command to remove a condition from an access list.
permit {source [source-wildcard] | any}
no permit {source [source-wildcard] | any}
permit protocol source source-wildcard destination destination-wildcard [precedence precedence] [tos tos]
no permit protocol source source-wildcard destination destination-wildcard
ICMP
permit icmp source source-wildcard destination destination-wildcard [icmp-type [icmp-code] | icmp-message] [precedence precedence] [tos tos]
IGMP
permit igmp source source-wildcard destination destination-wildcard [igmp-type] [precedence precedence] [tos tos]
TCP
permit tcp source source-wildcard [operator port [port]] destination destination-wildcard [operator port [port]] [precedence precedence] [tos tos]
UDP
permit udp source source-wildcard [operator port [port]] destination destination-wildcard [operator port [port]] [precedence precedence] [tos tos]
Syntax Description
Defaults
There are no specific conditions under which a packet passes the named access list.
Command Modes
Access-list configuration
Usage Guidelines
Use this command following the ip access-list command to define the conditions under which a packet passes the access list.
Examples
The following example sets conditions for a standard access list named Internetfilter:
Router(config)# ip access-list standard InternetfilterRouter(config)# deny 192.5.34.0 0.0.0.255Router(config)# permit 128.88.0.0 0.0.255.255Router(config)# permit 36.0.0.0 0.255.255.255! (Note: all other access implicitly denied)Related Commands
show access-lists
Use the show access-lists privileged EXEC command to display the contents of current access lists.
show access-lists [access-list-number | name]
Syntax Description
access-list-number
(Optional) Number of the access list to display. The system displays all access lists by default.
name
(Optional) Name of the IP access list to display.
Defaults
The system displays all access lists.
Command Modes
Privileged EXEC
Examples
The following is sample output from the show access-lists command when access list 101 is specified:
Router# show access-lists 101Extended IP access list 101permit tcp host 198.92.32.130 any established (4304 matches)permit udp host 198.92.32.130 any eq domain (129 matches)permit icmp host 198.92.32.130 anypermit tcp host 198.92.32.130 host 171.69.2.141 gt 1023permit tcp host 198.92.32.130 host 171.69.2.135 eq smtp (2 matches)permit tcp host 198.92.32.130 host 198.92.30.32 eq smtppermit tcp host 198.92.32.130 host 171.69.108.33 eq smtppermit udp host 198.92.32.130 host 171.68.225.190 eq syslogpermit udp host 198.92.32.130 host 171.68.225.126 eq syslogdeny ip 150.136.0.0 0.0.255.255 224.0.0.0 15.255.255.255deny ip 171.68.0.0 0.1.255.255 224.0.0.0 15.255.255.255 (2 matches)deny ip 172.24.24.0 0.0.1.255 224.0.0.0 15.255.255.255deny ip 192.82.152.0 0.0.0.255 224.0.0.0 15.255.255.255deny ip 192.122.173.0 0.0.0.255 224.0.0.0 15.255.255.255deny ip 192.122.174.0 0.0.0.255 224.0.0.0 15.255.255.255deny ip 192.135.239.0 0.0.0.255 224.0.0.0 15.255.255.255deny ip 192.135.240.0 0.0.7.255 224.0.0.0 15.255.255.255deny ip 192.135.248.0 0.0.3.255 224.0.0.0 15.255.255.255deny ip 192.150.42.0 0.0.0.255 224.0.0.0 15.255.255.255An access list counter counts how many packets are allowed by each line of the access list. This number is displayed as the number of matches.
Related Commands
show ip access-list
Use the show ip access-list EXEC command to display the contents of all current IP access lists.
show ip access-list [access-list-number | name]
Syntax Description
access-list-number
(Optional) Number of the IP access list to display.
name
(Optional) Name of the IP access list to display.
Defaults
Displays all standard and extended IP access lists.
Command Modes
EXEC
Usage Guidelines
The show ip access-list command provides output identical to the show access-lists command, except that it is IP-specific and allows you to specify a particular access list.
Examples
The following is sample output from the show ip access-list command when all are requested:
Router# show ip access-listExtended IP access list 101deny udp any any eq ntppermit tcp any anypermit udp any any eq tftppermit icmp any anypermit udp any any eq domainThe following is sample output from the show ip access-list command when the name of a specific access list is requested:
Router# show ip access-list InternetfilterExtended IP access list Internetfilterpermit tcp any 171.69.0.0 0.0.255.255 eq telnetdeny tcp any anydeny udp any 171.69.0.0 0.0.255.255 lt 1024deny ip any any logIPX Commands
access-list (IPX standard)
Use the standard version of the access-list global configuration command to define a standard IPX access list. Use the no form of this command to remove a standard access list.
access-list access-list-number {deny | permit} source-network [destination-network[.destination-node [destination-node-mask]]]
no access-list access-list-number {deny | permit} source-network [destination-network[.destination-node [destination-node-mask]]]
Syntax Description
Defaults
No access lists are predefined.
Command Modes
Global configuration
Usage Guidelines
Standard IPX access lists filter on the source network. All other parameters are optional.
Use the ipx access-group command to assign an access list to an interface. You can apply only one extended or one standard access list to an interface. The access list filters all outgoing packets on the interface.
To delete a standard access list, specify the minimum number of keywords and arguments needed to delete the proper access list. For example, to delete the entire access list, use the no access-list access-list-number command.
To delete the access list for a specific network, use the no access-list access-list-number {deny | permit} source-network command.
Examples
The following example denies access to traffic from all IPX networks (-1) to destination network 2:
Router(config)# access-list 800 deny -1 2The following example denies access to all traffic from IPX address 1.0000.0c00.1111:
Router(config)# access-list 800 deny 1.0000.0c00.1111The following example denies access from all nodes on network 1 that have a source address beginning with 0000.0c:
Router(config)# access-list 800 deny 1.0000.0c00.0000 0000.00ff.ffffThe following example denies access from source address 1111.1111.1111 on network 1 to destination address 2222.2222.2222 on network 2:
Router(config)# access-list 800 deny 1.1111.1111.1111 0000.0000.0000 2.2222.2222.2222 0000.0000.0000or
Router(config)# access-list 800 deny 1.1111.1111.1111 2.2222.2222.2222Related Commands
Sets conditions for a named IPX access list.
Applies generic input and output filters to an interface.
deny (standard)
Use the deny access-list configuration command to set conditions for a named IPX access list. Use the no form of this command to remove a deny condition from an access list.
deny source-network [destination-network[.destination-node [destination-node-mask]]]
no deny source-network [destination-network[.destination-node [destination-node-mask]]]
Syntax Description
Defaults
No access lists are defined.
Command Modes
Access-list configuration
Usage Guidelines
Use this command following the access-list (IPX standard) command to specify conditions under which a packet cannot pass the named access list.
For additional information on creating IPX access lists, see the access-list (IPX standard) command.
Examples
The following example creates a standard access list named fred. It denies communication with only IPX network number 5678.
Router(config)# ipx access-list standard fredRouter(config)# deny 5678 anyRouter(config)# permit anyRelated Commands
access-list (IPX standard)
Defines a standard IPX access list.
Applies generic input and output filters to an interface.
Displays the contents of all current IPX access lists.
ipx access-group
Use the ipx access-group interface configuration command to apply generic input and output filters to an interface. Use the no form of this command to remove filters.
ipx access-group {access-list-number | name} [in | out]
no ipx access-group {access-list-number | name} [in | out]
Syntax Description
Defaults
No filters are predefined.
Command Modes
Interface configuration
Usage Guidelines
Generic filters control which data packets an interface receives or sends out based on the packet's source and destination addresses, IPX protocol type, and source and destination socket numbers. You use the standard access-list and extended access-list commands to specify the filtering conditions.
You can apply only one input filter and one output filter per interface or subinterface.
When you do not specify an input (in) or output (out) filter in the command line, the default is an output filter.
Examples
The following example applies access list 801 to Gigabit interface 1. Because the command line does not specify an input filter or output filter with the keywords in or out, the software assumes that it is an output filter.
Router(config)# interface gigabit 1Router(config)# ipx access-group 801The following example applies access list 802 to Gigabit interface 1. The access list is an input filter access list as specified by the keyword in.
Router(config)# interface gigabit 1Router(config)# ipx access-group 802 inTo remove the input access list filter in the previous example, you must specify the in keyword when you use the no form of the command. The following example correctly removes the access list:
Router(config)# interface gigabit 1Router(config)# no ipx access-group 802 inRelated Commands
permit (IPX standard)
Use the permit access-list configuration command to set conditions for a named IPX access list. Use the no form of this command to remove a permit condition from an access list.
permit source-network [destination-network[.destination-node[destination-node-mask]]]
no permit source-network [destination-network[.destination-node[destination-node-mask]]]
Syntax Description
Defaults
No access lists are defined.
Command Modes
Access-list configuration
Usage Guidelines
Use this command following the access-list (IPX standard) command to specify conditions under which a packet passes the named access list.
For additional information on creating IPX access lists, see the access-list (IPX standard) command.
Examples
The following example creates a standard access list named fred. It permits communication with only IPX network number 5678.
Router(config)# ipx access-list standard fredRouter(config)# permit 5678 anyRouter(config)# deny anyRelated Commands
show ipx access-list
Use the show ipx access-list EXEC command to display the contents of all current IPX access lists.
show ipx access-list [access-list-number | name]
Syntax Description
access-list-number
(Optional) Number of the IPX access list to display. This is a number from 800 to 899.
name
(Optional) Name of the IPX access list to display.
Defaults
Displays all standard, extended, SAP, and NLSP route aggregation summary IPX access lists.
Command Modes
EXEC
Usage Guidelines
The show ipx access-list command provides output identical to the show access-lists command, except that it is IPX specific and allows you to specify a particular access list.
Examples
The following is sample output from the show ipx access-list command when all access lists are requested:
Router# show ipx access-listIPX extended access list 899deny any 1IPX sap access list Londondeny FFFFFFFF 107deny FFFFFFFF 301Cpermit FFFFFFFF 0The following is sample output from the show ipx access-list command when the name of a specific access list is requested:
Router# show ipx access-list LondonIPX sap access list Londondeny FFFFFFFF 107deny FFFFFFFF 301Cpermit FFFFFFFF 0
