IP Addresses and Services Configuration Guide for Cisco 8000 Series Routers, IOS XR Releases

PDF

IP Addresses and Services Configuration Guide for Cisco 8000 Series Routers, IOS XR Releases

IPv6 extension headers in ingress IPv6 hybrid ACLs

Updated: August 12, 2026

Want to summarize with AI?

Log in

This topic describes how ingress IPv6 hybrid ACLs with compression level 2 can filter packets on the basis of IPv6 extension headers on the Cisco 8000 Series Router.

As illustrated in the figure, an IPv6 packet may carry zero, one, or more extension headers, each identified by the Next Header field of the preceding header. To configure ingress hybrid ACLs with ACEs that permit or deny packets on the basis of IPv6 extension headers, the IPv6 extension headers must be set immediately after the base IPv6 header as shown in the figure.

Figure 1. IPv6 Extension Header in an IPv6 Packet

Therefore, you can filter ingress IPv6 packets through hybrid ACLs with compression level 2 on the basis of IPv6 extension headers set in them.

Note

You can filter ingress IPv6 packets having hop-by-hop extension headers through regular ACLs or through hybrid ACLs with compression level 2.

Feature History Table

Table 1. Feature History Table

Feature Name

Release Information

Description
IPv6 Extension Headers in Hybrid ACLs

Release 26.2.1

Introduced in this release on: Modular Systems (8800 [LC ASIC: P100]):*

*This feature is supported on Cisco 88-LC1-48Y8H-EM line cards.
IPv6 Extension Headers in Hybrid ACLs

Release 25.4.1

Introduced in this release on: Fixed Systems (8010 [ASIC: A100])(select variants only*)

*This feature is supported on:

  • 8011-32Y8L2H2FH

  • 8011-12G12X4Y-A/D
IPv6 Extension Headers in Hybrid ACLs

Release 25.1.1

Introduced in this release on: Fixed Systems (8700 [ASIC: K100], 8010 [ASIC: A100])(select variants only*)

This feature is supported on:

  • 8712-MOD-M

  • 8011-4G24Y4H-I
IPv6 Extension Headers in Hybrid ACLs

Release 24.4.1

Introduced in this release on: Fixed Systems (8200 [ASIC: P100], 8700 [ASIC: P100])(select variants only*); Modular Systems (8800 [LC ASIC: P100])(select variants only*)

*This feature is supported on:

  • 8212-48FH-M

  • 8711-32FH-M

  • 88-LC1-36EH

  • 88-LC1-12TH24FH-E

  • 88-LC1-52Y8H-EM
IPv6 Extension Headers in Hybrid ACLs

Release 7.3.15

You can configure ingress IPv6 hybrid ACLs with compression level 2 to permit or deny packets on the basis of IPv6 extension headers set in them. IPv6 extension headers include routing headers, authentication headers, and destination option headers. These extension headers contain information that is used by network devices (routers and switches) to route or process an ingress IPv6 packet.

The ipv6 access-group command is updated.

Configuration guidelines and restrictions for IPv6 extension headers in hybrid ACLs

The following restrictions apply when you configure IPv6 extension headers in ingress IPv6 hybrid ACLs:

  • You cannot configure a protocol and an IPv6 extension header in the same ACE. However, you can create separate ACEs with protocols and extension header in a single ACL.

  • You cannot filter egress IPv6 packets with hybrid ACLs that have compression level 2 and have IPv6 extension headers set as an ACE.

  • You cannot configure custom headers or mobility headers in an ACE filter ingress IPv6 packets through hybrid ACLs with compression level 2.

Configure IPv6 extension headers in ingress IPv6 hybrid ACLs

Use this procedure to create an ingress IPv6 hybrid ACL with compression level 2 based on IPv6 extension headers.

Procedure

  1. Enter the global configuration mode and create an IPv6 hybrid ACL with an ACE that has routing extension header.

    Example:

    Router# configure
Router(config)# ipv6 access-list ACL-EXT-HEADER
Router(config-ipv6-acl)# 10 deny ipv6 any any routing
Router(config-ipv6-acl)# 20 deny ospf any any
Router(config-ipv6-acl)# commit
Router(config-ipv6-acl)# exit

  2. Enter the interface configuration mode and configure an ingress interface with the hybrid ACL with compression level 2.

    Example:

    Router(config)# interface hundredGigE 0/4/0/36
Router(config-if)# ipv6 access-group ACL-EXT-HEADER ingress compress level 2
Router(config-if)# commit

    You have successfully configured IPv6 extension headers in an ingress IPv6 hybrid ACL.