deny-domain

Function

The deny-domain command specifies domains denied the access to the BAS interface.

The undo deny-domain command cancels the previous configuration.

By default, all domains are allowed to access the BAS interface.

This command is supported only on the NetEngine 8000 F1A.

Format

deny-domain domain-name &<1-16>

undo deny-domain [ domain-name ] &<1-16>

Parameters

Parameter	Description	Value
domain-name	Specifies domains denied the access to the BAS interface. The specified domains must be existing ones.	The value is string of 1 to 64 characters. A maximum of 16 domains can be specified by the command.

Parameter

Description

Value

domain-name

Specifies domains denied the access to the BAS interface. The specified domains must be existing ones.

The value is string of 1 to 64 characters. A maximum of 16 domains can be specified by the command.

Views

BAS interface view (GE), BAS interface view (VE), BAS interface view (trunk)

Default Level

2: Configuration level

Task Name and Operations

Task Name	Operations
bras-control	write

Usage Guidelines

Usage Scenario

To deny users in certain domains the right to access the BAS interface, you need to run the deny-domain command.

If the deny-domain command has not been run on the BAS interface, all domain users can access the BAS interface. Otherwise, the users of domains specified by the deny-domain command are not allowed to access the BAS interface.

Precautions

In VS mode, this command is supported only by the admin VS.

The deny-domain command and the permit-domain command are mutually exclusive.

Example

# Configure the BAS interface configured on GE 0/1/1 to deny the access of dom1 and dom2.

<HUAWEI> system-view
[~HUAWEI] aaa
[~HUAWEI-aaa] domain dom1
[~HUAWEI-aaa] domain dom2
[~HUAWEI-aaa-dom2] commit
[~HUAWEI-aaa-dom2] quit
[~HUAWEI-aaa] quit
[~HUAWEI] interface GigabitEthernet 0/1/1
[~HUAWEI-GigabitEthernet0/1/1] commit
[~HUAWEI-GigabitEthernet0/1/1] bas
[~HUAWEI-GigabitEthernet0/1/1-bas] access-type layer2-subscriber
[*HUAWEI-GigabitEthernet0/1/1-bas] commit
[~HUAWEI-GigabitEthernet0/1/1-bas] deny-domain dom1 dom2