IP Addresses and Services Configuration Guide for Cisco 8000 Series Routers, IOS XR Releases

PDF

IP Addresses and Services Configuration Guide for Cisco 8000 Series Routers, IOS XR Releases

IPv4 and IPv6 ACLs in Layer 2

Updated: August 12, 2026

Want to summarize with AI?

Log in

This topic describes how IPv4 and IPv6 access control lists (ACLs) operate on Layer 2 physical and bundle main interfaces on the Cisco 8000 Series Router to filter traffic at the data link layer.

Layer 2 ACLs are ethernet access control lists that operate at the data link layer of your network and filter traffic based on MAC addresses, VLAN tags, Ethernet type fields, and user or port-based authentication.

IPv4 and IPv6 ACLs are the Layer 3 access control lists that filter traffic based on IP addresses (IPv4 and IPv6) and other Layer 3 protocol information, such as protocol type, port numbers, and additional flags or control bits in the TCP header.

Feature History Table

Table 1. Feature History Table

Feature Name

Release Information

Description

IPv4 and IPv6 ACLs in Layer 2

Release 26.2.1

Introduced in this release on: Modular Systems (8800 [LC ASIC: P100]):*

*This feature is supported on:

  • 88-LC1-48Y8H-EM

IPv4 and IPv6 ACLs in Layer 2

Release 25.4.1

Introduced in this release on: Fixed Systems (8010 [ASIC: A100])(select variants only*)

*This feature is supported on:

  • 8011-32Y8L2H2FH

  • 8011-12G12X4Y-A/D

IPv4 and IPv6 ACLs in Layer 2

Release 25.1.1

Introduced in this release on: Fixed Systems (8010 [ASIC: A100])(select variants only*)

*This feature is supported on Cisco 8011-4G24Y4H-I routers.

IPv4 and IPv6 ACLs in Layer 2

Release 24.4.1

Introduced in this release on: Fixed Systems (8200 [ASIC: P100], 8700 [ASIC: P100, K100])(select variants only*); Modular Systems (8800 [LC ASIC: P100])(select variants only*)

*This feature is supported on:

  • 8212-48FH-M

  • 8711-32FH-M

  • 8712-MOD-M

  • 88-LC1-36EH

  • 88-LC1-12TH24FH-E

  • 88-LC1-52Y8H-EM

IPv4 and IPv6 ACLs in Layer 2

Release 24.2.11

You can now configure both IPv4 and IPv6 ACLs on Layer 2 interfaces. This functionality is supported on the physical and bundle main Layer 2 interfaces, enabling Layer 3 ACLs. With this feature, you can implement traffic filtering at Layer 2, effectively preventing undesired traffic from progressing deeper into the network, like using an IPv6 ACL as an IPv6 router advertisement (RA) guard.

Previously, IPv6 and IPv4 ACLs were not supported on Layer 2 interface.

IPv4 and IPv6 ACLs in Layer 2 interface

You can configure both IPv4 and IPv6 ACLs on the physical and bundle main Layer 2 interfaces. Additionally, you can enable Layer 2 (Ethernet) ACLs on the same interface simultaneously.

Advantages of IPv4 and IPv6 ACLs in Layer 2

  • IPv4 and IPv6 ACLs can control which devices can communicate with each other on the same VLAN or between VLANs, thus segmenting and isolating traffic for security purposes.

  • IP-based (IPv4 or IPv6) filtering at Layer 2 helps prevent unauthorized access to network resources.

  • IP address-based ACLs can limit unnecessary broadcast traffic to specific segments of the network, thereby reducing congestion and improving overall network performance.

  • IPv4 and IPv6 ACLs provide protocol-based traffic control, such as TCP, UDP, ICMP, and others.

Restrictions for IPv4 and IPv6 ACLs in Layer 2

The Cisco 8000 Series Router supports IPv4 and IPv6 ACLs on Layer 2 interfaces only in the ingress direction.

Layer 2 interfaces support IPv4 and IPv6 ACLs on the following interface types:

  • Physical main interfaces

  • Bundle main interfaces

The Cisco 8000 Series Router does not support IPv4 and IPv6 ACLs on Layer 2 interfaces after you configure ACL permit statistics collection using the hw-module profile stats acl-permit command. Disable ACL permit statistics collection using the no hw-module profile stats acl-permit command before you configure IPv4 and IPv6 ACLs. You must reload the router after using the no hw-module profile stats acl-permit command.

Configure IPv4 and IPv6 ACL on Layer 2 interface

Before you begin

Ensure that the following prerequisites are met:

  • Disable ACL statistics collection using the no hw-module profile stats acl-permit command.

  • Identify the Layer 2 physical main interface on the router. In this example: HundredGigE 0/0/0/23.

  • Identify the Layer 2 ACL. In this example: ETHERNET-ACL-INGRESS.

  • Identify the IPv4 ACL. In this example: V4-ACL-INGRESS.

  • Identify the IPv6 ACL. In this example: V6-ACL-INGRESS.

In this example, you apply IPv4, IPv6, and Layer 2 (Ethernet) ACLs to a Layer 2 physical interface, and the IPv6 ACL is configured to act as an IPv6 RA guard.

Procedure

  1. Add access control entries (ACEs) to the IPv6 access list so that it acts as an IPv6 RA guard.

    Example:

    Router(config)# ipv6 access-list V6-ACL-INGRESS
Router(config-ipv6-acl)# 30 deny icmpv6 any any router-advertisement
Router(config-ipv6-acl)# commit

  2. Apply the IPv4, IPv6, and Layer 2 (Ethernet) ACLs to the Layer 2 physical main interface in interface configuration mode.

    Example:

    Router(config)# interface HundredGigE 0/0/0/23
Router(config-if)# ipv4 access-group V4-ACL-INGRESS ingress
Router(config-if)# ipv6 access-group V6-ACL-INGRESS ingress
Router(config-if)# ethernet-services access-group ETHERNET-ACL-INGRESS ingress
Router(config-if)# commit

  3. Verify the configuration.

    Example:

    Router# show run interface HundredGigE 0/0/0/23
interface HundredGigE 0/0/0/23
 l2transport
 !
 ethernet-services access-group ETHERNET-ACL-INGRESS ingress
 ipv4 access-group V4-ACL-INGRESS ingress
 ipv6 access-group V6-ACL-INGRESS ingress
!