IP Addresses and Services Configuration Guide for Cisco 8000 Series Routers, IOS XR Releases

Control and management plane ACLs

Updated: August 12, 2026

Want to summarize with AI?

Explains how a virtual LPTS interface and compressed hybrid ACLs filter and police control and management plane traffic. Covers limitations, best practices, configuration, verification, and IPv6 AH and ESP support.

User-managed control and management plane access control lists (ACLs) are traffic-security controls that

create a virtual Local Packet Transport Services (LPTS) interface for router-bound traffic
apply compressed hybrid IPv4 and IPv6 ACLs to that interface, and
filter, police, prioritize, and log control and management plane traffic.

The data plane forwards user packets between interfaces. The control plane determines packet paths through routing protocols and related processes. The management plane provides device configuration and monitoring functions.

Table 1. Feature History Table
Feature Name	Release Information	Description
User Managed Control Plane and Management Plane ACL	Release 7.3.3 Release 7.5.2	You can create a virtual LPTS interface and apply hybrid ACLs to it for inspecting traffic. This functionality lets you use the hybrid ACLs to filter and customize the control plane and management plane traffic. This feature modifies the following command: hw-module profile cef

LPTS ACL mode

Use hw-module profile cef lpts acl to enable LPTS ACL mode. Apply one IPv4 ACL and one IPv6 ACL to the virtual LPTS interface with compression level 2.

Use no hw-module profile cef lpts acl to disable LPTS ACL mode.

Control and management plane ACL limitations

Review these limitations before you apply an access control list (ACL) to the virtual Local Packet Transport Services (LPTS) interface.

User-managed control and management plane ACLs have these limitations:

Use only object groups with compression level 2 in LPTS ACL mode.
Do not rely on these ACLs to filter hardware-offloaded BFD control packets.
An ACL lookup applies only during initial BFD session setup when the remote discriminator is zero. After the system learns the discriminator, established-session packets do not use this lookup.
A deny ACE with logging does not drop hardware-offloaded BFD packets. A deny ACE without logging can drop packets during initial session setup.
Reload the router after you add AH or ESP entries to an IPv6 ACL.

Do not use these protocol and port combinations to permit or deny packets in this ACL mode:

Table 2. Unsupported protocol and port combinations
Protocol	Ports
PTP	UDP ports 319 and 320
BFD	UDP ports 3784 and 3785
IPLSA	TCP port 1167 and UDP ports 1167 and 1967
TWAMP	TCP port 862

To deny traffic that uses an unsupported protocol and port combination, use a general deny ipv4 any any or deny ipv6 any any ACE.

Best practice: Protect control and management plane traffic

Recommendation: Use one virtual LPTS interface

Create one virtual Local Packet Transport Services (LPTS) interface and apply the required IPv4 and IPv6 hybrid access control lists (ACLs) to it.

Create all required object groups before you apply an ACL to the interface.
Apply each object-group ACL with compression level 2.

This recommendation applies when user-managed ACLs filter IPv4 or IPv6 control and management plane traffic.

One virtual interface provides a consistent attachment point for policies that protect router-bound traffic.

The router evaluates control and management plane traffic through the intended compressed ACLs.

Verify the hardware ACL entries on interface lpts0 after you apply the configuration.

Recommendation: Use explicit traffic actions

Apply policer, priority, and logging actions to the access control entries (ACEs) that require traffic control or operational visibility.

Enable logging on relevant ACEs to monitor accepted or denied traffic.
Use the icmp-on option to punt packets that match deny ACEs. Without this option, the router drops the packets by default.

This recommendation applies when an ACL must rate-limit, prioritize, log, or punt matched traffic.

Explicit ACE actions define the required traffic treatment and provide counters for operational verification.

The ACL controls matched traffic and records the information required for operational review.

Use hardware ACL statistics to confirm the accepted and dropped packet counts for each relevant ACE.

Configure an ACL for control and management plane traffic

Use this procedure to configure an access control list (ACL) that filters, polices, and prioritizes router-bound IPv4 and IPv6 traffic.

Before you begin

Create the network object groups referenced by the ACL entries.

Review the unsupported protocol and port combinations before you create the ACLs.

Warning

Enabling LPTS ACL mode and applying the policy requires a router reload. Schedule a maintenance window before you begin.

Procedure

Enable Local Packet Transport Services (LPTS) ACL mode.

Example:

Router# configure
Router(config)# hw-module profile cef lpts acl
Router(config)# commit

Create the IPv4 hybrid ACL.

Example:

Router(config)# ipv4 access-list test-umpp-v4-filter
Router(config-ipv4-acl)# 10 permit icmp net-group ACL_GROUP_1 any police 67 pps
Router(config-ipv4-acl)# 20 permit icmp net-group ACL_GROUP_2 any priority Medium
Router(config-ipv4-acl)# 30 permit icmp net-group ACL_GROUP_3 any priority High
Router(config-ipv4-acl)# 40 permit icmp net-group ACL_GROUP_4 any police 100 pps
Router(config-ipv4-acl)# 50 permit icmp any any 0
Router(config-ipv4-acl)# 60 permit icmp any any 3
Router(config-ipv4-acl)# priority-timeout 25
Router(config-ipv4-acl)# commit

Create the IPv6 hybrid ACL.

Example:

Router(config)# ipv6 access-list test-umpp-v6-filter
Router(config-ipv6-acl)# 10 permit icmpv6 net-group ACL_GROUP_1 any priority Medium
Router(config-ipv6-acl)# 20 permit icmpv6 net-group ACL_GROUP_2 any police 67 pps
Router(config-ipv6-acl)# 30 permit icmpv6 net-group ACL_GROUP_5 any priority Low
Router(config-ipv6-acl)# 40 permit icmpv6 net-group ACL_GROUP_6 any police 100 pps
Router(config-ipv6-acl)# 50 permit icmpv6 any any echo
Router(config-ipv6-acl)# 60 permit icmpv6 any any echo-reply
Router(config-ipv6-acl)# priority-timeout 25
Router(config-ipv6-acl)# commit

Apply both ACLs to the virtual LPTS interface with compression level 2.

Example:

Router(config)# interface lpts 0
Router(config-if)# ipv4 access-group test-umpp-v4-filter ingress compress level 2
Router(config-if)# ipv6 access-group test-umpp-v6-filter ingress compress level 2
Router(config-if)# commit

Reload the router to activate LPTS ACL mode.
Example:
```
Router# reload
```

Verify that LPTS ACL mode is applied and review the hardware ACL counters.

Example:

Router# show hw-module profile cef
--------------------------------------------------------------
Knob                          Status          Applied   Action         
--------------------------------------------------------------
CBF                           Unconfigured    N/A       None           
BGPLU                         Unconfigured    N/A       None           
LPTS ACL                      Configured      Yes       None         
..


Router# show access-lists test-umpp-v4-filter hardware ingress interface lpts 0 location 0/RP0/CPU0
10 permit icmp net-group ACL_GROUP_1 any police 67 pps (Accepted: 14 packets, Dropped: 0 packets)
20 permit icmp net-group ACL_GROUP_2 any priority Medium
30 permit icmp net-group ACL_GROUP_3 any priority High
40 permit icmp net-group ACL_GROUP_4 any police 100 pps (Accepted: 25 packets, Dropped: 0 packets)
50 permit icmp any any 0
60 permit icmp any any 3


Router# show access-lists ipv6 test-umpp-v6-filter hardware ingress interface lpts 0 location 0/RP0/CPU0
10 permit icmp net-group ACL_GROUP_1 any priority Medium
20 permit icmp net-group ACL_GROUP_2 any police 67 pps (Accepted: 3 packets, Dropped: 0 packets)
30 permit icmp net-group ACL_GROUP_5 any priority Low 
40 permit icmp net-group ACL_GROUP_6 any police 100 pps (Accepted: 35 packets, Dropped: 0 packets)
50 permit icmp any any echo
60 permit icmp any any echo-reply

The profile output reports LPTS ACL as configured and applied. The ACL output reports accepted and dropped packets for ACEs with policer actions.

The virtual LPTS interface filters control and management plane traffic through the configured IPv4 and IPv6 ACLs.

AH and ESP headers in IPv6 ACLs

Authentication Header (AH) and Encapsulating Security Payload (ESP) support in user-managed IPv6 access control lists (ACLs) is an IPsec traffic-filtering capability that

matches Authentication Header traffic with the ahp protocol keyword
matches Encapsulating Security Payload traffic with the esp protocol keyword, and
permits or denies matched packets at the virtual LPTS interface.

AH provides data integrity and data-origin authentication. ESP provides data confidentiality.

Table 3. Feature History Table
Feature Name	Release Information	Description
Authentication Header (AH) and Encapsulating Security Payload (ESP) Headers Support in User Managed Control Plane and Management Plane ACLs	Release 25.4.1	Introduced in this release on: Fixed Systems (8010 [ASIC: A100])(select variants only) This feature is supported on: 8011-32Y8L2H2FH 8011-12G12X4Y-A/D
Authentication Header (AH) and Encapsulating Security Payload (ESP) Headers Support in User Managed Control Plane and Management Plane ACLs	Release 25.1.1	Introduced in this release on: Fixed Systems (8700 [ASIC: K100], 8010 [ASIC: A100])(select variants only*) This feature is supported on: 8712-MOD-M 8011-4G24Y4H-I
Authentication Header (AH) and Encapsulating Security Payload (ESP) Headers Support in User Managed Control Plane and Management Plane ACLs	Release 24.4.1	Introduced in this release on: Fixed Systems (8200 [ASIC: P100], 8700 [ASIC: P100])(select variants only); Modular Systems (8800 [LC ASIC: P100])(select variants only) *This feature is supported on: 8212-48FH-M 8711-32FH-M 88-LC1-36EH 88-LC1-12TH24FH-E 88-LC1-52Y8H-EM
Authentication Header (AH) and Encapsulating Security Payload (ESP) Headers Support in User Managed Control Plane and Management Plane ACLs	Release 7.10.1	This feature enhances traffic security by introducing the Authentication Header (AH) and Encapsulating Security Payload (ESP) IPv6 headers in the IPv6 ACLs. While AH provides data integrity and data origin authentication, ESP is for data confidentiality. You can configure ingress IPv6 ACL extensions for AH and ESP headers to permit or deny packets. These protocols ensure that the sensitive information travelling on the network reaches its destination safely.

Activation requirement

Reload the router after you add AH or ESP entries to an IPv6 ACL that is applied to the virtual Local Packet Transport Services (LPTS) interface.

Configure an IPv6 ACL for AH and ESP headers

Use this procedure to permit Authentication Header (AH) and Encapsulating Security Payload (ESP) packets through a user-managed control and management plane IPv6 access control list (ACL).

Before you begin

Confirm that the router release and platform support AH and ESP protocol matching in IPv6 ACLs.

Warning

This configuration requires a node reload. Schedule a maintenance window before you begin.

Procedure

Enable Local Packet Transport Services (LPTS) ACL mode if it is not already enabled.

Example:

Router# configure
Router(config)# hw-module profile cef lpts acl
Router(config)# commit

Create IPv6 ACL entries that permit AH and ESP packets.

Example:

Router(config)# ipv6 access-list ipv6_umpp_access_list
Router(config-ipv6-acl)# 12 permit ahp any any
Router(config-ipv6-acl)# 14 permit esp any any
Router(config-ipv6-acl)# commit

Apply and commit the IPv6 ACL to the virtual LPTS interface with compression level 2.

Example:

Router(config)# interface lpts0
Router(config-if)# ipv6 access-group ipv6_umpp_access_list ingress compress level 2
Router(config-if)# commit

Reload the node to activate AH and ESP matching.
Example:
```
Router# reload location 0/0/CPU0
```

Verify that the hardware ACL permits AH and ESP packets.

Example:

Router# show access-lists ipv6 ipv6_umpp_access_list hardware ingress interface lpts0 location 0/RP0/CPU0
ipv6 access-list ipv6_umpp_access_list
12 permit ahp any any (Accepted: 246524 packets, Dropped: 0 packets)
14 permit esp any any (Accepted: 246524 packets, Dropped: 0 packets)

The output lists the permit ahp and permit esp entries with accepted and dropped packet counters.

The virtual LPTS interface permits AH and ESP packets that match the configured IPv6 ACL entries.

Need help?

Open a support case

(Requires a Cisco Service Contract)

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.