Cisco IOS IPv6 Command Reference - ip name-server through ipv6 general-prefix [Support]

Table Of Contents

ip name-server

ip route-cache

ip router isis

ipv6 access-class

ipv6 access-list

ipv6 access-list log-update threshold

ipv6 address

ipv6 address anycast

ipv6 address autoconfig

ipv6 address eui-64

ipv6 address link-local

ipv6 atm-vc

ipv6 authentication key-chain eigrp

ipv6 authentication mode eigrp

ipv6 bandwidth-percent eigrp

ipv6 cef

ipv6 cef accounting

ipv6 cef distributed

ipv6 dhcp client information refresh minimum

ipv6 dhcp client pd

ipv6 dhcp database

ipv6 dhcp pool

ipv6 dhcp relay destination

ipv6 dhcp server

ipv6 eigrp

ipv6 enable

ipv6 flow

ipv6 flow mask

ipv6 flow mask option-headers

ipv6 flow-aggregation cache

ipv6 flow-cache entries

ipv6 flow-cache timeout

ipv6 flow-export destination

ipv6 flow-export source

ipv6 flow-export template

ipv6 flow-export template options

ipv6 flow-export version 9

ipv6 general-prefix

ip name-server

To specify the address of one or more name servers to use for name and address resolution, use the ip name-server command in global configuration mode. To remove the addresses specified, use the no form of this command.

ip name-server [vrf vrf-name] server-address1 [server-address2...server-address6]
no ip name-server [vrf vrf-name] server-address1 [server-address2...server-address6]
Syntax Description

vrf vrf-name

(Optional) Defines a Virtual Private Network (VPN) routing and forwarding instance (VRF) table. The vrf-name argument specifies a name for the VRF table.

server-address1

IPv4 or IPv6 addresses of a name server.

server-address2...server-address6

(Optional) IP addresses of additional name servers (a maximum of six name servers).

Command Default

No name server addresses are specified.

Command Modes

Global configuration

Command History

Release

Modification

10.0

This command was introduced.

12.2(2)T

Support for IPv6 addresses was added.

12.0(21)ST

Support for IPv6 addresses was added.

12.0(22)S

Support for IPv6 addresses was added.

12.2(14)S

Support for IPv6 addresses was added.

12.2(28)SB

This command was integrated into Cisco IOS Release 12.2(28)SB.

12.2(25)SG

This command was integrated into Cisco IOS Release 12.2(25)SG.

12.4(4)T

The vrf keyword and vrf-name argument were added.

12.2(33)SRA

This command was integrated into Cisco IOS Release 12.2(33)SRA.

12.2(33)SXH

This command was integrated into Cisco IOS Release 12.2(33)SXH.

Examples

The following example shows how to specify IPv4 hosts 172.16.1.111 and 172.16.1.2 as the name servers:
ip name-server 172.16.1.111 172.16.1.2
This command will be reflected in the configuration file as follows:
ip name-server 172.16.1.111
ip name-server 172.16.1.2
The following example shows how to specify IPv4 hosts 172.16.1.111 and 172.16.1.2 as the name servers for vpn1:

Router(config)# ip name-server vrf vpn1 172.16.1.111 172.16.1.2
The following example shows how to specify IPv6 hosts 3FFE:C00::250:8BFF:FEE8:F800 and 2001:0DB8::3 as the name servers:
ip name-server 3FFE:C00::250:8BFF:FEE8:F800 2001:0DB8::3 
This command will be reflected in the configuration file as follows:
ip name-server 3FFE:C00::250:8BFF:FEE8:F800 
ip name-server 2001:0DB8::3
Related Commands

Command

Description

ip domain-lookup

Enables the IP DNS-based hostname-to-address translation.

ip domain-name

Defines a default domain name to complete unqualified hostnames (names without a dotted decimal domain name).

ip route-cache

To control the use of switching methods for forwarding IP packets, use the ip route-cache command in interface configuration mode. To disable any of these switching methods, use the no form of this command.

ip route-cache [cef | distributed | flow | policy | same-interface]
no ip route-cache [cef | distributed | flow | policy | same-interface]
Syntax Description

cef

(Optional) Enables Cisco Express Forwarding operation on an interface.

distributed

(Optional) Enables distributed switching on the interface. (This keyword is not supported on the Cisco 7600 routers.)

flow

(Optional) Enables NetFlow accounting for packets that are received by the interface.

policy

(Optional) Enables fast-switching for packets that are forwarded using policy-based routing (PBR).

same-interface

(Optional) Enables fast-switching of packets onto the same interface on which they arrived.

Defaults

Fast Switching

The default behavior for Fast Switching varies by interface and media.

Distributed Switching

Distributed switching is disabled.

Cisco Express Forwarding and Distributed Cisco Express Forwarding

When Cisco Express Forwarding or distributed Cisco Express Forwarding operation is enabled globally, all interfaces that support Cisco Express Forwarding or distributed Cisco Express Forwarding are enabled by default.

NetFlow Accounting

NetFlow accounting is disabled.

Fast Switching for PBR (FSPBR)

FSPBR is disabled.

Command Modes

Interface configuration (config-if)

Command History

Release

Modification

10.0

This command was introduced.

11.1

The flow keyword was added.

11.2GS

The cef and distributed keywords were added.

11.1CC

cef keyword support was added for multiple platforms.

12.0

The policy keyword was added.

12.2(25)S

This command was integrated into Cisco IOS Release 12.2(25)S. The ip route-cache flow command is automatically remapped to the ip flow ingress command.

12.2(28)SB

This command was integrated into Cisco IOS Release 12.2(28)SB. This command is not supported on the Cisco 10000 series router.

12.2(33)SRA

This command was integrated into Cisco IOS Release 12.2(33)SRA.

12.2(33)SXH

This command was integrated into Cisco IOS Release 12.2(33)SXH.

12.4(20)T

This command was integrated into Cisco IOS Release 12.4(20)T.

Usage Guidelines

IP Route Cache

Note The Cisco 10000 series routers do not support the ip route-cache command.

Using the route cache is often called fast switching. The route cache allows outgoing packets to be load-balanced on a per-destination basis rather than on a per-packet basis. The ip route-cache command with no additional keywords enables fast switching.

Entering the ip route-cache command has no effect on a subinterface. Subinterfaces accept the no form of the command; however, this disables Cisco Express Forwarding or distributed Cisco Express Forwarding on the physical interface and all subinterfaces associated with the physical interface

IP Route Cache Same Interface

You can enable IP fast switching when the input and output interfaces are the same interface, using the ip route-cache same-interface command. This configuration normally is not recommended, although it is useful when you have partially meshed media, such as Frame Relay or you are running Web Cache Communication Protocol (WCCP) redirection. You could use this feature on other interfaces, although it is not recommended because it would interfere with redirection of packets to the optimal path.

IP Route Cache Flow

The flow caching option can be used in conjunction with Cisco Express Forwarding switching to enable NetFlow, which allows statistics to be gathered with a finer granularity. The statistics include IP subprotocols, well-known ports, total flows, average number of packets per flow, and average flow lifetime.

Note The ip route-cache flow command has the same functionality as the ip flow ingress command, which is the preferred command for enabling NetFlow. If either the ip route-cache flow command or the
ip flow ingress command is configured, both commands will appear in the output of the
show running-config command.

IP Route Cache Distributed

The distributed option is supported on Cisco routers with line cards and Versatile Interface Processors (VIPs) that support Cisco Express Forwarding switching.

On Cisco routers with Route/Switch Processor (RSP) and VIP controllers, the VIP hardware can be configured to switch packets received by the VIP with no per-packet intervention on the part of the RSP. When VIP distributed switching is enabled, the input VIP interface tries to switch IP packets instead of forwarding them to the RSP for switching. Distributed switching helps decrease the demand on the RSP.

If the ip route-cache distributed, ip cef distributed, and ip route-cache flow commands are configured, the VIP performs distributed Cisco Express Forwarding switching and collects a finer granularity of flow statistics.

IP Route-Cache Cisco Express Forwarding

In some instances, you might want to disable Cisco Express Forwarding or distributed Cisco Express Forwarding on a particular interface because that interface is configured with a feature that
Cisco Express Forwarding or distributed Cisco Express Forwarding does not support. Because all interfaces that support Cisco Express Forwarding or distributed Cisco Express Forwarding are enabled by default when you enable Cisco Express Forwarding or distributed Cisco Express Forwarding operation globally, you must use the no form of the ip route-cache distributed command in the interface configuration mode to turn Cisco Express Forwarding or distributed Cisco Express Forwarding operation off a particular interface.

Disabling Cisco Express Forwarding or distributed Cisco Express Forwarding on an interface disables Cisco Express Forwarding or distributed Cisco Express Forwarding switching for packets forwarded to the interface, but does not affect packets forwarded out of the interface.

Additionally, when you disable distributed Cisco Express Forwarding on the RSP, Cisco IOS software switches packets using the next-fastest switch path (Cisco Express Forwarding).

Enabling Cisco Express Forwarding globally disables distributed Cisco Express Forwarding on all interfaces. Disabling Cisco Express Forwarding or distributed Cisco Express Forwarding globally enables process switching on all interfaces.

Note On the Cisco 12000 series Internet router, you must not disable distributed Cisco Express Forwarding on an interface.

IP Route Cache Policy

If Cisco Express Forwarding is already enabled, the ip route-cache route command is not required because PBR packets are Cisco Express Forwarding-switched by default.

Before you can enable fast-switched PBR, you must first configure PBR.

FSPBR supports all of PBR's match commands and most of PBR's set commands, with the following restrictions:

•The set ip default next-hop and set default interface commands are not supported.

•The set interface command is supported only over point-to-point links, unless a route cache entry exists using the same interface specified in the set interface command in the route map.
Also, at the process level, the routing table is consulted to determine if the interface is on a reasonable path to the destination. During fast switching, the software does not make this check. Instead, if the packet matches, the software blindly forwards the packet to the specified interface.

Note Not all switching methods are available on all platforms. Refer to the Cisco Product Catalog for information about features available on the platform you are using.

Examples

Configuring Fast Switching and Disabling Cisco Express Forwarding Switching

The following example shows how to enable fast switching and disable Cisco Express Forwarding switching:
Router(config)# interface ethernet 0/0/0
Router(config-if)# ip route-cache
The following example shows that fast switching is enabled:
Router# show ip interface fastEthernet 0/0/0   
FastEthernet0/0/0 is up, line protocol is up
  Internet address is 10.1.1.254/24
  Broadcast address is 255.255.255.224
  Address determined by non-volatile memory
  MTU is 1500 bytes
  Helper address is not set
  Directed broadcast forwarding is disabled
  Multicast reserved groups joined: 224.0.0.10
  Outgoing access list is not set
  Inbound  access list is not set
  Proxy ARP is enabled
  Security level is default
  Split horizon is enabled
  ICMP redirects are always sent
  ICMP unreachables are always sent
  ICMP mask replies are never sent
  IP fast switching is enabled
  IP fast switching on the same interface is disabled
  IP Flow switching is disabled
  IP Distributed switching is disabled
  IP Feature Fast switching turbo vector
  IP Null turbo vector
  IP multicast fast switching is enabled
The following example shows that Cisco Express Forwarding switching is disabled:
Router# show cef interface fastEthernet 0/0/0
FastEthernet0/0/0 is up (if_number 3)
  Corresponding hwidb fast_if_number 3
  Corresponding hwidb firstsw->if_number 3
  Internet address is 10.1.1.254/24
  ICMP redirects are always sent
  Per packet load-sharing is disabled
  IP unicast RPF check is disabled
  Inbound access list is not set
  Outbound access list is not set
  IP policy routing is disabled
  Hardware idb is FastEthernet0/0/0
  Fast switching type 1, interface type 18
  IP CEF switching disabled
  IP Feature Fast switching turbo vector
  IP Null turbo vector
  Input fast flags 0x0, Output fast flags 0x0
  ifindex 1(1)
  Slot 0 Slot unit 0 VC -1
  Transmit limit accumulator 0x48001A02 (0x48001A02)
  IP MTU 1500
The following example shows the configuration information for interface fastethernet 0/0/0:
Router# show running-config
.
.
!
interface FastEthernet0/0/0
 ip address 10.1.1.254 255.255.255.0
 no ip route-cache cef
 no ip route-cache distributed
!
The following example shows how to enable Cisco Express Forwarding (and to disable distributed
Cisco Express Forwarding if it is enabled):
Router(config-if)# ip route-cache cef
The following example shows how to enable VIP distributed Cisco Express Forwarding and per-flow accounting on an interface (regardless of the previous switching type enabled on the interface):
Router(config)# interface e0
Router(config-if)# ip address 10.252.245.2 255.255.255.0
Router(config-if)# ip route-cache distributed
Router(config-if)# ip route-cache flow
The following example shows how to enable Cisco Express Forwarding on the router globally (which also disables distributed Cisco Express Forwarding on any interfaces that are running distributed
Cisco Express Forwarding), and disable Cisco Express Forwarding (which enables process switching) on Ethernet interface 0:
Router(config)# ip cef 
Router(config)# interface e0
Router(config-if)# no ip route-cache cef
The following example shows how to enable distributed Cisco Express Forwarding operation on the router (globally), and disable Cisco Express Forwarding operation on Ethernet interface 0:
Router(config)# ip cef distributed 
Router(config)# interface e0
Router(config-if)# no ip route-cache cef
The following example shows how to reenable distributed Cisco Express Forwarding operation on Ethernet interface 0:
Router(config)# ip cef distributed 
Router(config)# interface e0
Router(config-if)# ip route-cache distributed
Configuring Fast Switching for Traffic That Is Received and Transmitted over the Same Interface

The following example shows how to enable fast switching and disable Cisco Express Forwarding switching:
Router(config)# interface ethernet 0/0/0
Router(config-if)# ip route-cache same-interface
The following example shows that fast switching on the same interface is enabled for interface fastethernet 0/0/0:
Router# show ip interface fastEthernet 0/0/0  
FastEthernet0/0/0 is up, line protocol is up
  Internet address is 10.1.1.254/24
  Broadcast address is 255.255.255.224
  Address determined by non-volatile memory
  MTU is 1500 bytes
  Helper address is not set
  Directed broadcast forwarding is disabled
  Multicast reserved groups joined: 224.0.0.10
  Outgoing access list is not set
  Inbound  access list is not set
  Proxy ARP is enabled
  Security level is default
  Split horizon is enabled
  ICMP redirects are always sent
  ICMP unreachables are always sent
  ICMP mask replies are never sent
  IP fast switching is enabled
  IP fast switching on the same interface is enabled
  IP Flow switching is disabled
  IP Distributed switching is disabled
  IP Feature Fast switching turbo vector
  IP Null turbo vector
  IP multicast fast switching is enabled
  IP multicast distributed fast switching is disabled
  IP route-cache flags are Fast
  Router Discovery is disabled
  IP output packet accounting is disabled
  IP access violation accounting is disabled
  TCP/IP header compression is disabled
  RTP/IP header compression is disabled
  Probe proxy name replies are disabled
  Policy routing is disabled
  Network address translation is disabled
  WCCP Redirect outbound is disabled
  WCCP Redirect inbound is disabled
  WCCP Redirect exclude is disabled
  BGP Policy Mapping is disabled
  IP multicast multilayer switching is disabled
The following example shows the configuration information for interface fastethernet 0/0/0:
Router# show running-config
.
.
!
interface FastEthernet0/0/0
 ip address 10.1.1.254 255.255.255.0
 ip route-cache same-interface
 no ip route-cache cef
 no ip route-cache distributed
!
Enabling NetFlow Accounting

The following example shows how to enable NetFlow switching:
Router(config)# interface ethernet 0/0/0
Router(config-if)# ip route-cache flow
The following example shows that NetFlow accounting is enabled for interface fastethernet 0/0/0:
Router# show ip interface fastEthernet 0/0/0 
FastEthernet0/0/0 is up, line protocol is up
  Internet address is 10.1.1.254/24
  Broadcast address is 255.255.255.224
  Address determined by non-volatile memory
  MTU is 1500 bytes
  Helper address is not set
  Directed broadcast forwarding is disabled
  Multicast reserved groups joined: 224.0.0.10
  Outgoing access list is not set
  Inbound  access list is not set
  Proxy ARP is enabled
  Security level is default
  Split horizon is enabled
  ICMP redirects are always sent
  ICMP unreachables are always sent
  ICMP mask replies are never sent
  IP fast switching is enabled
  IP fast switching on the same interface is disabled
  IP Flow switching is enabled
  IP Distributed switching is disabled
  IP Flow switching turbo vector
  IP Null turbo vector
  IP multicast fast switching is enabled
  IP multicast distributed fast switching is disabled
  IP route-cache flags are Fast, Flow
  Router Discovery is disabled
  IP output packet accounting is disabled
  IP access violation accounting is disabled
  TCP/IP header compression is disabled
  RTP/IP header compression is disabled
  Probe proxy name replies are disabled
  Policy routing is disabled
  Network address translation is disabled
  WCCP Redirect outbound is disabled
  WCCP Redirect inbound is disabled
  WCCP Redirect exclude is disabled
  BGP Policy Mapping is disabled
  IP multicast multilayer switching is disabled
Configuring Distributed Switching

The following example shows how to enable distributed switching:
Router(config)# ip cef distributed
Router(config)# interface ethernet 0/0/0
Router(config-if)# ip route-cache distributed
The following example shows that distributed Cisco Express Forwarding switching is for interface fastethernet 0/0/0:
Router# show cef interface fastEthernet 0/0/0
FastEthernet0/0/0 is up (if_number 3)
  Corresponding hwidb fast_if_number 3
  Corresponding hwidb firstsw->if_number 3
  Internet address is 10.1.1.254/24
  ICMP redirects are always sent
  Per packet load-sharing is disabled
  IP unicast RPF check is disabled
  Inbound access list is not set
  Outbound access list is not set
  IP policy routing is disabled
  Hardware idb is FastEthernet0/0/0
  Fast switching type 1, interface type 18
  IP Distributed CEF switching enabled
  IP Feature Fast switching turbo vector
  IP Feature CEF switching turbo vector
  Input fast flags 0x0, Output fast flags 0x0
  ifindex 1(1)
  Slot 0 Slot unit 0 VC -1
  Transmit limit accumulator 0x48001A02 (0x48001A02)
  IP MTU 1500
Configuring Fast Switching for PBR

The following example shows how to configure a simple policy-based routing scheme and to enable FSPBR:
Router(config)# access-list 1 permit 10.1.1.0 0.0.0.255
Router(config)# route-map mypbrtag permit 10
Router(config-route-map)# match ip address 1
Router(config-route-map)# set ip next-hop 10.1.1.195
Router(config-route-map)# exit
Router(config)# interface fastethernet 0/0/0
Router(config-if)# ip route-cache policy
Router(config-if)# ip policy route-map mypbrtag
The following example shows that FSPBR is enabled for interface fastethernet 0/0/0:
Router# show ip interface fastEthernet 0/0/0
FastEthernet0/0/0 is up, line protocol is up
  Internet address is 10.1.1.254/24
  Broadcast address is 255.255.255.255
  Address determined by non-volatile memory
  MTU is 1500 bytes
  Helper address is not set
  Directed broadcast forwarding is disabled
  Multicast reserved groups joined: 224.0.0.10
  Outgoing access list is not set
  Inbound  access list is not set
  Proxy ARP is enabled
  Security level is default
  Split horizon is enabled
  ICMP redirects are always sent
  ICMP unreachables are always sent
  ICMP mask replies are never sent
  IP fast switching is enabled
  IP fast switching on the same interface is disabled
  IP Flow switching is disabled
  IP CEF switching is enabled
  IP Distributed switching is enabled
  IP Feature Fast switching turbo vector
  IP Feature CEF switching turbo vector
  IP multicast fast switching is enabled
  IP multicast distributed fast switching is disabled
  IP route-cache flags are Fast, Distributed, Policy, CEF
  Router Discovery is disabled
  IP output packet accounting is disabled
  IP access violation accounting is disabled
  TCP/IP header compression is disabled
  RTP/IP header compression is disabled
  Probe proxy name replies are disabled
  Policy routing is enabled, using route map my_pbr_tag
  Network address translation is disabled
  WCCP Redirect outbound is disabled
  WCCP Redirect inbound is disabled
  WCCP Redirect exclude is disabled
  BGP Policy Mapping is disabled
  IP multicast multilayer switching is disabled
Related Commands

Command

Description

exit

Leaves aggregation cache mode.

ip cef

Enables Cisco Express Forwarding on the RP card.

ip cef distributed

Enables distributed Cisco Express Forwarding operation.

ip flow ingress

Configures NetFlow on a subinterface.

show ip interface

Displays the usability status of interfaces configured for IP.

show cef interface

Displays detailed Cisco Express Forwarding information for interfaces.

show mpoa client

Displays the routing table cache used to fast switch IP traffic.

set ip default next-hop

Configures a default IP next hop for PBR.

set default interface

Configures a default interface for PBR.

set interface

Configures a specified interface for PBR.

ip router isis

To configure an Intermediate System-to-Intermediate System (IS-IS) routing process for IP on an interface and to attach an area designator to the routing process, use the ip router isis command in interface configuration mode. To disable IS-IS for IP, use the no form of the command.

ip router isis area-tag
no ip router isis area-tag
Syntax Description

area-tag

Meaningful name for a routing process. If it is not specified, a null tag is assumed and the process is referenced with a null tag. This name must be unique among all IP or Connectionless Network Service (CLNS) router processes for a given router.

Required for multiarea IS-IS configuration. Optional for conventional IS-IS configuration.

Note Each area in a multiarea configuration should have a nonnull area tag to facilitate identification of the area.

Defaults

No routing processes are specified.

Command Modes

Interface configuration

Command History

Release

Modification

10.0

This command was introduced.

12.0(5)T

Multiarea functionality was added, changing the way the tag argument (now area-tag) is used.

12.2(28)SB

This command was integrated into Cisco IOS Release 12.2(28)SB.

12.2(33)SRA

This command was integrated into Cisco IOS Release 12.2(33)SRA.

12.2(33)SRB

Support for IPv6 was added.

12.2(33)SXH

This command was integrated into Cisco IOS Release 12.2(33)SXH.

12.2(33)SB

Support for IPv6 was added.

Usage Guidelines

Before the IS-IS routing process is useful, a network entity title (NET) must be assigned with the net command and some interfaces must have IS-IS enabled.

If you have IS-IS running and at least one International Organization for Standardization Interior Gateway Routing Protocol (ISO-IGRP) process, the IS-IS process and the ISO-IGRP process cannot both be configured without an area tag. The null tag can be used by only one process. If you run ISO-IGRP and IS-IS, a null tag can be used for IS-IS, but not for ISO-IGRP at the same time. However, each area in an IS-IS multiarea configuration should have a nonnull area tag to facilitate identification of the area.

You can configure only one process to perform Level 2 (interarea) routing. If Level 2 routing is configured on any process, all additional processes are automatically configured as Level 1. You can configure this process to perform intra-area (Level 1) routing at the same time. You can configure up to 29 additional processes as Level 1-only processes. Use the is-type command to remove Level 2 routing from a router instance. You can then use the is-type command to enable Level 2 routing on some other IS-IS router instance.

An interface cannot be part of more than one area, except in the case where the associated routing process is performing both Level 1 and Level 2 routing. On media such as WAN media where subinterfaces are supported, different subinterfaces could be configured for different areas.

Examples

The following example specifies IS-IS as an IP routing protocol for a process named Finance, and specifies that the Finance process will be routed on Ethernet interface 0 and serial interface 0:
router isis Finance
 net 49.0001.aaaa.aaaa.aaaa.00
interface Ethernet 0
 ip router isis Finance
interface serial 0
 ip router isis Finance
The following example shows an IS-IS configuration with two Level 1 areas and one Level 1-2 area:
ip routing
.
.
.
interface Tunnel529
 ip address 10.0.0.5 255.255.255.0
 ip router isis BB
interface Ethernet1
 ip address 10.1.1.5 255.255.255.0
 ip router isis A3253-01
!
interface Ethernet2
 ip address 10.2.2.5 255.255.255.0
 ip router isis A3253-02
.
.
.
! Defaults to "is-type level-1-2"
router isis BB
 net 49.2222.0000.0000.0005.00
!
router isis A3253-01
 net 49.0553.0001.0000.0000.0005.00
 is-type level-1
!
router isis A3253-02
 net 49.0553.0002.0000.0000.0005.00
 is-type level-1
Related Commands

Command

Description

is-type

Configures the routing level for an IS-IS routing process.

net

Configures an IS-IS NET for a CLNS routing process.

router isis

Enables the IS-IS routing protocol.

ipv6 access-class

To filter incoming and outgoing connections to and from the router based on an IPv6 access list, use the ipv6 access-class command in line configuration mode. To disable the filtering of incoming and outgoing connections to the router, use the no form of this command.

ipv6 access-class ipv6-access-list-name {in | out}
no ipv6 access-class
Syntax Description

ipv6-access-list-name

Name of an IPv6 access list. Names cannot contain a space or quotation mark, or begin with a numeric.

in

Filters incoming IPv6 connections.

out

Filters outgoing IPv6 connections.

Command Default

The filtering of incoming and outgoing connections to and from the router is not enabled.

Command Modes

Line configuration

Command History

Release

Modification

12.2(2)T

This command was introduced.

12.0(21)ST

This command was integrated into Cisco IOS Release 12.0(21)ST.

12.0(22)S

This command was integrated into Cisco IOS Release 12.0(22)S.

12.2(14)S

This command was integrated into Cisco IOS Release 12.2(14)S.

12.2(28)SB

This command was integrated into Cisco IOS Release 12.2(28)SB.

12.2(25)SG

This command was integrated into Cisco IOS Release 12.2(25)SG.

12.2(33)SRA

This command was integrated into Cisco IOS Release 12.2(33)SRA.

12.2(33)SXH

This command was integrated into Cisco IOS Release 12.2(33)SXH.

Usage Guidelines

The ipv6 access-class command is similar to the access-class command, except that it is IPv6-specific.

The incoming connection source address is used to match against the access list source prefix. The router address on the received interface is used to match against the access list destination prefix.

IPv6 access control list (ACL) matches are made using TCP; an ACL permit match using IPv6 or TCP is required to allow access to a router.

Examples

The following example filters incoming connections on virtual terminal lines 0 to 4 of the router based on the IPv6 access list named cisco:
ipv6 access-list cisco
 permit ipv6 host 2001:0DB8:0:4::2/128 any
line vty 0 4
 ipv6 access-class cisco in
Related Commands

Command

Description

ipv6 access-list

Defines an IPv6 access list and sets deny or permit conditions for the defined access list.

ipv6 traffic-filter

Filters incoming or outgoing IPv6 traffic on an interface.

show ipv6 access-list

Displays the contents of all current IPv6 access lists.

ipv6 access-list

To define an IPv6 access list and to place the router in IPv6 access list configuration mode, use the ipv6 access-list command in global configuration mode. To remove the access list, use the no form of this command.

ipv6 access-list access-list-name
no ipv6 access-list access-list-name
Syntax Description

access-list-name

Name of the IPv6 access list. Names cannot contain a space or quotation mark, or begin with a numeric.

Command Default

No IPv6 access list is defined.

Command Modes

Global configuration

Command History

Release

Modification

12.2(2)T

This command was introduced.

12.0(21)ST

This command was integrated into Cisco IOS Release 12.0(21)ST.

12.0(22)S

This command was integrated into Cisco IOS Release 12.0(22)S.

12.0(23)S

Support for IPv6 address configuration mode and extended access list functionality (the filtering of traffic based on IPv6 option headers and optional, upper-layer protocol type information) was added. Additionally, the following keywords and arguments were moved from global configuration mode to IPv6 access list configuration mode: permit,
deny, source-ipv6-prefix/prefix-length, any, destination-ipv6-prefix/
prefix-length, priority. See the "Usage Guidelines" section for more details.

12.2(13)T

Support for IPv6 address configuration mode and extended access list functionality (the filtering of traffic based on IPv6 option headers and optional, upper-layer protocol type information) was added. Additionally, the following keywords and arguments were moved from global configuration mode to IPv6 access list configuration mode: permit,
deny, source-ipv6-prefix/prefix-length, any, destination-ipv6-prefix/
prefix-length, priority. See the "Usage Guidelines" section for more details.

12.2(14)S

This command was integrated into Cisco IOS Release 12.2(14)S.

12.2(28)SB

This command was integrated into Cisco IOS Release 12.2(28)SB.

12.2(25)SG

This command was integrated into Cisco IOS Release 12.2(25)SG.

12.2(33)SRA

This command was integrated into Cisco IOS Release 12.2(33)SRA.

12.2(33)SXH

This command was integrated into Cisco IOS Release 12.2(33)SXH.

Usage Guidelines

The ipv6 access-list command is similar to the ip access-list command, except that it is IPv6-specific.

In Cisco IOS Release 12.2(2)T or later releases, 12.0(21)ST, and 12.0(22)S, standard IPv6 access control list (ACL) functionality is used for basic traffic filtering functions—traffic filtering is based on source and destination addresses, inbound and outbound to a specific interface, and with an implicit deny statement at the end of each access list (functionality similar to standard ACLs in IPv4). IPv6 ACLs are defined and their deny and permit conditions are set by using the ipv6 access-list command with the deny and permit keywords in global configuration mode.

In Cisco IOS Release 12.0(23)S or later releases, the standard IPv6 ACL functionality is extended to support—in addition to traffic filtering based on source and destination addresses—filtering of traffic based on IPv6 option headers and optional, upper-layer protocol type information for finer granularity of control (functionality similar to extended ACLs in IPv4). IPv6 ACLs are defined by using the ipv6 access-list command in global configuration mode and their permit and deny conditions are set by using the deny and permit commands in IPv6 access list configuration mode. Configuring the ipv6 access-list command places the router in IPv6 access list configuration mode—the router prompt changes to Router(config-ipv6-acl)#. From IPv6 access list configuration mode, permit and deny conditions can be set for the defined IPv6 ACL.

Note IPv6 ACLs are defined by a unique name (IPv6 does not support numbered ACLs). An IPv4 ACL and an IPv6 ACL cannot share the same name.

In Cisco IOS Release 12.0(23)S or later releases, and 12.2(11)S or later releases, for backward compatibility, the ipv6 access-list command with the deny and permit keywords in global configuration mode is still supported; however, an IPv6 ACL defined with deny and permit conditions in global configuration mode is translated to IPv6 access list configuration mode.

Refer to the deny (IPv6) and permit (IPv6) commands for more information on filtering IPv6 traffic based on IPv6 option headers and optional, upper-layer protocol type information. See the "Examples" section for an example of a translated IPv6 ACL configuration.

Note In Cisco IOS Release 12.0(23)S or later releases, every IPv6 ACL has implicit permit icmp any any nd-na, permit icmp any any nd-ns, and deny ipv6 any any statements as its last match conditions. (The former two match conditions allow for ICMPv6 neighbor discovery.) An IPv6 ACL must contain at least one entry for the implicit deny ipv6 any any statement to take effect.

The IPv6 neighbor discovery process makes use of the IPv6 network layer service; therefore, by default, IPv6 ACLs implicitly allow IPv6 neighbor discovery packets to be sent and received on an interface. In IPv4, the Address Resolution Protocol (ARP), which is equivalent to the IPv6 neighbor discovery process, makes use of a separate data link layer protocol; therefore, by default, IPv4 ACLs implicitly allow ARP packets to be sent and received on an interface.

Note IPv6 prefix lists, not access lists, should be used for filtering routing protocol prefixes.

Use the ipv6 traffic-filter interface configuration command with the access-list-name argument to apply an IPv6 ACL to an IPv6 interface. Use the ipv6 access-class line configuration command with the access-list-name argument to apply an IPv6 ACL to incoming and outgoing IPv6 virtual terminal connections to and from the router.

Note An IPv6 ACL applied to an interface with the ipv6 traffic-filter command filters traffic that is forwarded, not originated, by the router.

Note When using this command to modify an ACL that is already associated with a bootstrap router (BSR) candidate rendezvous point (RP) (see the ipv6 pim bsr candidate rp command) or a static RP (see the ipv6 pim rp-address command), any added address ranges that overlap the PIM SSM group address range (FF3x::/96) are ignored. A warning message is generated and the overlapping address ranges are added to the ACL, but they have no effect on the operation of the configured BSR candidate RP or static RP commands.

Examples

The following example is from a router running Cisco IOS Release 12.0(23)S or later releases. The example configures the IPv6 ACL list named list1 and places the router in IPv6 access list configuration mode.
Router(config)# ipv6 access-list list1
Router(config-ipv6-acl)#
The following example is from a router running Cisco IOS Release 12.2(2)T or later releases, 12.0(21)ST, or 12.0(22)S. The example configures the IPv6 ACL named list2 and applies the ACL to outbound traffic on Ethernet interface 0. Specifically, the first ACL entry keeps all packets from the network FEC0:0:0:2::/64 (packets that have the site-local prefix FEC0:0:0:2 as the first 64 bits of their source IPv6 address) from exiting out of Ethernet interface 0. The second entry in the ACL permits all other traffic to exit out of Ethernet interface 0. The second entry is necessary because an implicit deny all condition is at the end of each IPv6 ACL.
Router(config)# ipv6 access-list list2 deny FEC0:0:0:2::/64 any
Router(config)# ipv6 access-list list2 permit any any
Router(config)# interface ethernet 0
Router(config-if)# ipv6 traffic-filter list2 out
If the same configuration was entered on a router running Cisco IOS Release 12.0(23)S or later releases, the configuration would be translated into IPv6 access list configuration mode as follows:
ipv6 access-list list2 
  deny FEC0:0:0:2::/64 any
  permit ipv6 any any
interface ethernet 0
 ipv6 traffic-filter list2 out
Note IPv6 is automatically configured as the protocol type in permit any any and deny any any statements that are translated from global configuration mode to IPv6 access list configuration mode.

Note IPv6 ACLs defined on a router running Cisco IOS Release 12.2(2)T or later releases, 12.0(21)ST, or 12.0(22)S that rely on the implicit deny condition or specify a deny any any statement to filter traffic should contain permit statements for link-local and multicast addresses to avoid the filtering of protocol packets (for example, packets associated with the neighbor discovery protocol). Additionally, IPv6 ACLs that use deny statements to filter traffic should use a permit any any statement as the last statement in the list.

Note An IPv6 router will not forward to another network an IPv6 packet that has a link-local address as either its source or destination address (and the source interface for the packet is different from the destination interface for the packet).

Related Commands

Command

Description

deny (IPv6)

Sets deny conditions for an IPv6 access list.

ipv6 access-class

Filters incoming and outgoing connections to and from the router based on an IPv6 access list.

ipv6 pim bsr candidate rp

Configures the candidate RP to send PIM RP advertisements to the BSR.

ipv6 pim rp-address

Configure the address of a PIM RP for a particular group range.

ipv6 traffic-filter

Filters incoming or outgoing IPv6 traffic on an interface.

permit (IPv6)

Sets permit conditions for an IPv6 access list.

show ipv6 access-list

Displays the contents of all current IPv6 access lists.

ipv6 access-list log-update threshold

To specify the number of updates that are logged for IPv6 access lists, use the ipv6 access-list log-update threshold command in global configuration mode. To return the number of logged updates to the default setting, use the no form of this command.

ipv6 access-list log-update threshold value
no ipv6 access-list log-update threshold
Syntax Description

value

Specifies the number of updates that are logged for every IPv6 access list configured on the router. The acceptable range is from 0 to 2147483647.

Command Default

The default is 2147483647 updates.

Command Modes

Global configuration

Command History

Release

Modification

12.0(23)S

This command was introduced.

12.2(13)T

This command was integrated into Cisco IOS Release 12.2(13)T.

12.2(14)S

This command was integrated into Cisco IOS Release 12.2(14)S.

12.2(28)SB

This command was integrated into Cisco IOS Release 12.2(28)SB.

12.2(33)SRA

This command was integrated into Cisco IOS Release 12.2(33)SRA.

12.2(33)SXH

This command was integrated into Cisco IOS Release 12.2(33)SXH.

Usage Guidelines

The ipv6 access-list log-update threshold command is similar to the ip access-list log-update threshold command, except that it is IPv6-specific.

IPv6 ACL updates are logged at five minute intervals, following the first logged update. Configuring a lower number of updates (a number lower than the default) is useful when more frequent update logging is desired.

Examples

The following example configures a log threshold of ten updates for every IPv6 access list configured on the router.
ipv6 access-list log-update threshold 10
Related Commands

Command

Description

ipv6 access-list

Defines an IPv6 access list and enters IPv6 access list configuration mode.

show ipv6 access-list

Displays the contents of all current IPv6 access lists.

ipv6 address

To configure an IPv6 address based on an IPv6 general prefix and enable IPv6 processing on an interface, use the ipv6 address command in interface configuration mode. To remove the address from the interface, use the no form of this command.

ipv6 address {ipv6-address/prefix-length | prefix-name sub-bits/prefix-length | [%vrf-name]}
no ipv6 address {ipv6-address/prefix-length | prefix-name sub-bits/prefix-length | [%vrf-name]}
Syntax Description

ipv6-address

The IPv6 address to be used.

/prefix-length

The length of the IPv6 prefix. A decimal value that indicates how many of the high-order contiguous bits of the address comprise the prefix (the network portion of the address). A slash mark must precede the decimal value.

prefix-name

A general prefix, which specifies the leading bits of the network to be configured on the interface.

sub-bits

The subprefix bits and host bits of the address to be concatenated with the prefixes provided by the general prefix specified with the prefix-name argument.

The sub-bits argument must be in the form documented in RFC 2373 where the address is specified in hexadecimal using 16-bit values between colons.

% vrf-name

(Optional) Virtual private network (VPN) routing/forwarding instance (VRF) name.

Command Default

No IPv6 addresses are defined for any interface.

Command Modes

Interface configuration

Command History

Release

Modification

12.3(4)T

This command was introduced.

12.2(28)SB

This command was integrated into Cisco IOS Release 12.2(28)SB.

12.2(25)SG

This command was integrated into Cisco IOS Release 12.2(25)SG.

12.2(33)SRA

This command was integrated into Cisco IOS Release 12.2(33)SRA.

12.2(33)SRB

The % keyword and vrf-name argument were added.

12.2(33)SXH

This command was integrated into Cisco IOS Release 12.2(33)SXH.

Usage Guidelines

The ipv6 address command allows multiple IPv6 addresses to be configured on an interface in various different ways, with varying options. The most common way is to specify the IPv6 address with the prefix length.

Addresses may also be defined using the general prefix mechanism, which separates the aggregated IPv6 prefix bits from the subprefix and host bits. In this case, the leading bits of the address are defined in a general prefix, which is globally configured or learned (for example, through use of DHCP-PD), and then applied using the prefix-name argument. The subprefix bits and host bits are defined using the sub-bits argument.

Using the no ipv6 address autoconfig command without arguments removes all IPv6 addresses from an interface.

Examples

The following example shows how to enable IPv6 processing on the interface and configure an address based on the general prefix called my-prefix and the directly specified bits:
Router(config-if) ipv6 address my-prefix 0:0:0:7272::72/64
Assuming the general prefix named my-prefix has the value of 2001:DB8:2222::/48, then the interface would be configured with the global address 2001:DB8:2222:7272::72/64.

Related Commands

Command

Description

ipv6 address anycast

Configures an IPv6 anycast address and enables IPv6 processing on an interface.

ipv6 address eui-64

Configures a