Cisco 300 Series Cli Manual page 847

Small business 300 series managed switches command line interface guide release 1.3

Hide thumbs Also See for 300 Series:

Table of Contents

Denial of Service (DoS) Commands

78-21075-01 Command Line Interface Reference Guide

security-suite deny icmp

{ip-address | any} {mask | /prefix-length}]}

no security-suite deny icmp

ip-address | any—Specifies the destination IP address. Use any to specify

all IP addresses.

mask—Specifies the network mask of the IP address.

prefix-length—Specifies the number of bits that comprise the IP address

prefix. The prefix length must be preceded by a forward slash (/).

Default Configuration

Echo requests are allowed from all interfaces.

If mask is not specified, it defaults to 255.255.255.255.

If prefix-length is not specified, it defaults to 32.

Command Mode

Interface Configuration (Ethernet, Port-channel) mode

User Guidelines

For this command to work,

and for interfaces.

This command discards ICMP packets with "ICMP type= Echo request" that

ingress the specified interface.

The following example attempts to discard echo requests from an interface.

switchxxxxxx(config)#

switchxxxxxx(config-if)#

To perform this command, DoS Prevention must be enabled in the per-interface mode.

{[add {ip-address | any} {mask | /prefix-length}] | [remove

security-suite enable

security-suite enable global-rules-only

security-suite deny icmp add any /

must be enabled both globally