IP Addresses and Services Configuration Guide for Cisco 8000 Series Routers, IOS XR Releases

PDF

IP Addresses and Services Configuration Guide for Cisco 8000 Series Routers, IOS XR Releases

IPv6 ACLs

Updated: August 12, 2026

Want to summarize with AI?

Log in

This topic introduces IPv6 access control lists (ACLs) on the Cisco 8000 Series Router, which you can create and apply to interfaces to filter IP version 6 (IPv6) traffic.

You can filter IP version 6 (IPv6) traffic by creating IPv6 access control lists (ACLs) and applying them to interfaces similar to the way that you create and apply IP version 4 (IPv4) named ACLs.

Feature History Table

Table 1. Feature History Table

Feature Name

Release Information

Feature Description

Filter Ingress IPv6 ACL Traffic based on ACL Hop Limit

Release 26.2.1

Introduced in this release on: Modular Systems (8800 [LC ASIC: P100]):*

*This feature is supported on Cisco 88-LC1-48Y8H-EM line cards.

Filter Ingress IPv6 ACL Traffic based on ACL Hop Limit

Release 25.4.1

Introduced in this release on: Fixed Systems (8010 [ASIC: A100])(select variants only*)

*This feature is supported on:

  • 8011-32Y8L2H2FH

  • 8011-12G12X4Y-A/D

Filter Ingress IPv6 ACL Traffic based on ACL Hop Limit

Release 25.1.1

Introduced in this release on: Fixed Systems (8700 [ASIC: K100], 8010 [ASIC: A100])(select variants only*)

This feature is supported on:

  • 8712-MOD-M

  • 8011-4G24Y4H-I

Filter Ingress IPv6 ACL Traffic based on ACL Hop Limit

Release 24.4.1

Introduced in this release on: Fixed Systems (8200 [ASIC: P100], 8700 [ASIC: P100])(select variants only*); Modular Systems (8800 [LC ASIC: P100])(select variants only*)

*This feature is supported on:

  • 8212-48FH-M

  • 8711-32FH-M

  • 88-LC1-36EH

  • 88-LC1-12TH24FH-E

  • 88-LC1-52Y8H-EM

Filter Ingress IPv6 ACL Traffic based on ACL Hop Limit

Release 7.8.1

We ensure that IPv6 packets have a limited lifetime on your networks, thus reducing the impact of any routing loops and preventing networking failures. To that end, we have added the option to set hop limit rules in the ACLs based on the following hop limit match criteria:

  • eq - equal to

  • lt - less than

  • gt - greater than

  • range - ranges from 1 to 255

To set the hop limit, use the ttl keyword in the following commands:

Configuration guidelines and restrictions for ingress IPv6 ACLs

These restrictions and guidelines apply while configuring IPv6 ingress ACLs:

  • Ingress IPv6 ACLs are supported on all interfaces.

  • From Release 7.3.1 onwards, the maximum number of ACLs allowed per router is 126.

    In earlier releases, for the Cisco 8100 and 8200 Series fixed chassis, the maximum number of ACLs allowed per router is 45. For the Cisco 8800 modular chassis, the maximum number of ACLs allowed per router is 30.

  • Packet length (using the pkt-length keyword) is not supported.

  • IPv6 hop limit is supported only on ingress traffic with object-group ACL (compression level 2).

  • From Release 7.8.1 onwards, ACL logging with input interface (using the log-input keyword) is supported.

Configuration guidelines and restrictions for egress IPv6 ACLs

The following restrictions and guidelines apply while configuring IPv6 egress ACLs:

  • In IPv6 egress ACLs, TCP flag filtering does not function for IPv6 packets with a fragmentation header. As a result, IPv6 packets with both a fragmentation header and a TCP header (ACK+SYN flags) are not appropriately filtered by the ACL rules.

Configure an ingress IPv6 ACL on a HundredGigE interface

Use this procedure to configure an ingress IPv6 ACL on a HundredGigE interface.

Procedure

  1. Configure a HundredGigE interface with an IPv6 address.

    Example:

    Router(config)# interface HundredGigE 0/0/0/0
Router(config-if)# ipv6 address 2001::1/64
Router(config-if)# no shut
Router(config-if)# commit
Router(config-if)# exit

  2. Verify that the interface is up.

    Example:

    Router(config)# do show ipv6 interface brief
Thu Jul 11 09:28:43.657 UTC
HundredGigE 0/0/0/0 [Up/Up]
    fe80::bd:b9ff:fea9:5606
    2001::1

  3. Create an IPv6 ingress access control list (ACL) named V6-INGRESS-ACL and add rules.

    Example:

    Router(config)# ipv6 access-list V6-INGRESS-ACL
Router(config-ipv6-acl)# 10 permit ipv6 any any
Router(config-ipv6-acl)# 20 deny udp any any
Router(config-ipv6-acl)# commit
Router(config-ipv6-acl)# exit

  4. Verify the ingress ACL creation.

    Example:

    Router(config)# do show access-lists ipv6
Thu Jul 11 09:41:37.260 UTC
ipv6 access-list V6-INGRESS-ACL
 10 permit ipv6 any any
 20 deny udp any any

  5. Apply the ingress ACL to the HundredGigE interface.

    Router(config)# interface HundredGigE 0/0/0/0
Router(config-if)# ipv6 access-group V6-INGRESS-ACL ingress
Router(config-if)# commit
Router(config-if)# exit

  6. Verify that the ingress ACL has been successfully applied to the interface.

    Example:

    Router(config)# do show ipv6 interface

    You have successfully configured an IPv6 ingress ACL on a HundredGigE interface.

Configure an egress IPv6 ACL on a HundredGigE interface

Use this procedure to configure an egress IPv6 ACL on a HundredGigE interface.

Procedure

  1. Configure a HundredGigE interface with an IPv6 address.

    Example:

    Router(config)# interface HundredGigE 0/0/0/1
Router(config-if)# ipv6 address 2001::1/64
Router(config-if)# no shut
Router(config-if)# commit
Router(config-if)# exit

  2. Verify that the interface is up.

    Example:

    Router(config)# do show ipv6 interface brief
Thu Jul 11 09:47:50.812 UTC
HundredGigE 0/0/0/0 [Up/Up]
    fe80::bd:b9ff:fea9:5606
    1001::1
HundredGigE 0/0/0/1 [Up/Up]
    fe80::23:e9ff:fea8:a44e
    2001::1

  3. Create an IPv6 egress access control list (ACL) named V6-EGRESS-ACL and add rules.

    Example:

    Router(config)# ipv6 access-list V6-EGRESS-ACL
Router(config-ipv6-acl)# 10 permit ipv6 any any
Router(config-ipv6-acl)# 20 deny udp any any
Router(config-ipv6-acl)# commit
Router(config-ipv6-acl)# exit

  4. Verify the egress ACL creation.

    Example:

    Router(config)# do show access-lists ipv6
Thu Jul 11 09:51:16.687 UTC
ipv6 access-list V6-EGRESS-ACL
 10 permit ipv6 any any
 20 deny udp any any

  5. Apply the egress ACL to the HundredGigE interface.

    Router(config)# interface HundredGigE 0/0/0/1
Router(config-if)# ipv6 access-group V6-EGRESS-ACL egress
Router(config-if)# commit
Router(config-if)# exit

  6. Verify that the egress ACL has been successfully applied to the interface.

    Example:

    Router(config)# do show ipv6 interface

    You have successfully configured an IPv6 egress ACL on a HundredGigE interface.

Configure ingress and egress IPv6 ACLs on bundle interfaces

Use this procedure to configure ingress and egress IPv6 ACLs on a bundle interface.

Procedure

  1. Configure a bundle interface with an IPv6 address.

    Example:

    Router(config)# interface Bundle-Ether 1
Router(config-if)# ipv6 address 2001::1/64
Router(config-if)# no shut
Router(config-if)# commit
Router(config-if)# exit

  2. Configure an IPv6 egress ACL for the bundle interface.

    Example:

    Router(config)# ipv6 access-list V6-EGRESS-ACL-bundle interface
Router(config-ipv6-acl)# 10 permit tcp any any range 3000 4000
Router(config-ipv6-acl)# 20 permit ipv6 any any
Router(config-ipv6-acl)# commit
Router(config-ipv6-acl)# exit

  3. Configure an IPv6 ingress ACL to deny ingress traffic on the bundle interface.

    Example:

    Router(config)# ipv6 access-list V6-DENY-INGRESS-ACL
Router(config-ipv6-acl)# 10 deny ipv6 any any
Router(config-ipv6-acl)# commit
Router(config-ipv6-acl)# exit

  4. Verify the egress and ingress ACL creation.

    Example:

    Router(config)# do show access-lists ipv6
Thu Jul 11 10:04:35.798 UTC
ipv6 access-list V6-DENY-INGRESS-ACL
 10 deny ipv6 any any
ipv6 access-list V6-EGRESS-ACL-BI
 10 permit tcp any any range 3000 4000
 20 permit ipv6 any any

  5. Apply the egress and ingress ACLs to the bundle interface.

    Router(config)# interface Bundle-Ether 1
Router(config-if)# ipv6 access-group V6-EGRESS-ACL-BI egress
Router(config-if)# ipv6 access-group V6-DENY-INGRESS-ACL ingress
Router(config-if)# commit
Router(config-if)# exit

  6. Verify that the ACLs have been successfully applied to the interface.

    Example:

    Router(config)# do show ipv6 interface

    You have successfully configured ingress and egress IPv6 ACLs on a bundle interface.

Ingress IPv6 ACL with hop limit

Similar to the Time to Live (TTL) field in the IPv4 packet header, the TTL field is referred to as hop limit field in IPv6 packets. To filter an IPv6 packet on your source interface, you can define the following criteria as hop limit value that you set in your ACLs:

  • Equal (eq) — permit or deny a packet if the hop limit matches the value as defined in the ACL.

  • Less than (lt) — permit or deny a packet if the hop limit matches the value as defined in the ACL.

  • Greater than (gt) — permit or deny a packet if the hop limit is greater than as defined in the ACL.

  • Range — permit or deny a packet if the hop limit range matches as defined in the ACL.

Note

Hop limit is referred to as ttl .

Feature History Table

Table 2. Feature History Table

Feature Name

Release Information

Feature Description

Filter Ingress IPv6 ACL Traffic based on ACL Hop Limit

Release 26.2.1

Introduced in this release on: Modular Systems (8800 [LC ASIC: P100]):*

*This feature is supported on Cisco 88-LC1-48Y8H-EM line cards.

Filter Ingress IPv6 ACL Traffic based on ACL Hop Limit

Release 25.4.1

Introduced in this release on: Fixed Systems (8010 [ASIC: A100])(select variants only*)

*This feature is supported on:

  • 8011-32Y8L2H2FH

  • 8011-12G12X4Y-A/D

Filter Ingress IPv6 ACL Traffic based on ACL Hop Limit

Release 25.1.1

Introduced in this release on: Fixed Systems (8700 [ASIC: K100], 8010 [ASIC: A100])(select variants only*)

This feature is supported on:

  • 8712-MOD-M

  • 8011-4G24Y4H-I

Filter Ingress IPv6 ACL Traffic based on ACL Hop Limit

Release 24.4.1

Introduced in this release on: Fixed Systems (8200 [ASIC: P100], 8700 [ASIC: P100])(select variants only*); Modular Systems (8800 [LC ASIC: P100])(select variants only*)

*This feature is supported on:

  • 8212-48FH-M

  • 8711-32FH-M

  • 88-LC1-36EH

  • 88-LC1-12TH24FH-E

  • 88-LC1-52Y8H-EM

Filter Ingress IPv6 ACL Traffic based on ACL Hop Limit

Release 7.8.1

We ensure that IPv6 packets have a limited lifetime on your networks, thus reducing the impact of any routing loops and preventing networking failures. To that end, we have added the option to set hop limit rules in the ACLs based on the following hop limit match criteria:

  • eq - equal to

  • lt - less than

  • gt - greater than

  • range - ranges from 1 to 255

To set the hop limit, use the ttl keyword in the following commands:

Configure an ingress IPv6 ACL with hop limit on a bundle interface

Use this procedure to configure an ingress IPv6 ACL with hop limit on a bundle interface. In the following example, the hop limit criteria, equal (eq) and range (range) is used to filter the traffic. While deny action is used for the 'eq' criteria, permit action is used for 'range' criteria. This means that packets that matches the 'eq' criteria will be denied and the packets that matches the 'range' criteria will be permitted.

Procedure

  1. Configure a bundle interface with an IPv6 address.

    Example:

    Router(config)# interface Bundle-Ether 1
Router(config-if)# ipv6 address 2001::1/64
Router(config-if)# no shut
Router(config-if)# commit
Router(config-if)# exit

  2. Create an object group with the list of hosts.

    Example:

    Router(config)# object-group network ipv6 network_object_group_bundle_host
Router(config-object-group-ipv6)# host 140:1:2::1
Router(config-object-group-ipv6)# host 150:1:2::1
Router(config-object-group-ipv6)# host 160:1:2::1
Router(config-object-group-ipv6)# commit
Router(config-object-group-ipv6)# exit

  3. Apply the ACL definition to filter packets based on hop-limit match on IPv6.

    Example:

    Router(config)# ipv6 access-list ipv6_ob_network_tcp_bundle_ingress_main
Router(config-if)# 10 deny tcp net-group network_object_group_bundle_host net-group network_object_group_bundle_host ttl eq 205
Router(config-if)# 20 permit udp net-group network_object_group_bundle_host net-group network_object_group_bundle_host ttl range 250 255 log-input
!

  4. Associate the ACL configuration onto the ingress interface to match based on IPv6 hop limit.

    Router(config)# interface Bundle-Ether500
Router(config-if)# ipv4 address 30.1.0.1 255.255.255.0
Router(config-if)# ipv6 address 30:1::1/96
Router(config-if)# ipv6 access-group ipv6_ob_network_tcp_bundle_ingress_main ingress compress level 2
!

  5. Verify the running configuration of the IPv6 ingress ACL with hop limit.

    Example:

    Router:R1# sh access-lists ipv6 ipv6_ob_network_tcp_bundle_ingress_main hardware ingress detail location 0/0/CPU0
Fri Nov  4 06:39:15.155 UTC

ipv6_ob_network_tcp_bundle_ingress_main Details:
Sequence Number: 10
NPU ID: 0
Number of DPA Entries: 1
ACL ID: 1
ACE Action: DENY
ACE Logging: DISABLED
ABF Action: 0(ABF_NONE)
Hit Packet Count: 0
Source Address: 0:1:0:1::
 Source Address Mask: 0:0:0:0::
Destination Address: 0:0:0:0::
 Destination Address Mask: 0:0:0:0::
DPA Entry: 1
	Entry Index: 0
	DPA Handle: 0x8E8A10A8
	TTL Match: 0xCD (Mask 0xFF)
Sequence Number: 20
NPU ID: 0
Number of DPA Entries: 2
ACL ID: 1
ACE Action: PERMIT
ACE Logging: ENABLED
ABF Action: 0(ABF_NONE)
Hit Packet Count: 71
Source Address: 0:1:0:1::
 Source Address Mask: 0:0:0:0::
Destination Address: 0:0:0:0::
 Destination Address Mask: 0:0:0:0::
DPA Entry: 1
	Entry Index: 0
	DPA Handle: 0x8E8A1398
	TTL Match: 0xFA (Mask 0xFE)
DPA Entry: 2
	Entry Index: 1
	DPA Handle: 0x8E8A1688
	TTL Match: 0xFC (Mask 0xFC)
<Output truncated>

  6. Verify the ACL hit count for the ACE and the ACL logging.

    Example:

    Router(config)# show running-config | i hw
Fri Nov 4 06:26:27.382 UTC
Building configuration...
hw-module profile stats acl-permit

Router(config)# sh access-lists ipv6 ipv6_ob_network_tcp_bundle_ingress_main h i location 0/0/CPU0
Fri Nov  4 06:38:43.664 UTC
ipv6 access-list ipv6_ob_network_tcp_bundle_ingress_main
 10 deny tcp net-group network_object_group_bundle_host net-group network_object_group_bundle_host ttl eq 205
 20 permit udp net-group network_object_group_bundle_host net-group network_object_group_bundle_host ttl range 250 255 log-input (71 matches)

Router(config)# show logging | i permit
Mon Nov  7 06:42:30.146 UTC
Router:Nov  7 06:41:59.614 UTC: ipv6_acl_daemon[396]: %ACL-IPV6_ACL-6-IPACCESSLOGNP : access-list ipv6_ob_network_tcp_bundle_ingress_main (20) permit 58 150:1:2::1 (Bundle-Ether500)-> 140:1:2::1, 1 packet

    You have successfully configured an IPv6 ingress ACL on a bundle interface with hop limit. For more information on logging messages, see IP access list logging messages.