deny icmpTo drop all or specific internet control message protocol (ICMP) messages, configure a filter.Syntax deny icmp {source mask | any | host ip-address} {destination mask | any | hostip-address} [type] [dscp] [count [byte] [order] [fragments] [monitor [session-ID]] [no-drop]To remove this filter, you have two choices:• Use the no seq sequence-number command if you know the filter’s sequence number.• Use the no deny icmp {source mask | any | host ip-address} {destination mask |any | host ip-address} command.Parameters source Enter the IP address of the network or host from which the packets were sent.mask Enter a network mask in /prefix format (/x) or A.B.C.D. The mask, when specified inA.B.C.D format, may be either contiguous or non-contiguous.any Enter the keyword any to specify that all routes are subject to the filter.host ip-address Enter the keyword host then the IP address to specify a host IP address.destination Enter the IP address of the network or host to which the packets are sent.type Enter the ICMP packet type. The following types are available:For IPv4:echo countecho-reply counthost-unreachable counthost-unknown countnetwork-unknown countnet-unreachable countpacket-too-big countparameter-problem countport-unreachable countsource-quench counttime-exceeded countFor IPv6:echo countecho-reply countnd-ns countnd-na countpacket-too-big countparameter-problem counttime-exceeded countport-unreachable countThe ICMP packets cannot be filtered using mirroring ACL.dscp Enter this keyword dscp to deny a packet based on the DSCP value. The range is from 0to 63.count (OPTIONAL) Enter the keyword count to count packets processed by the filter.Access Control Lists (ACL) 201
