The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.
With IPv4, you can configure standard and extended numbered IP ACLs, named IP ACLs, and MAC ACLs. IPv6 supports only named ACLs.
The device does not support matching on these keywords: flowlabel, routing header, and undetermined-transport.
The device does not support reflexive ACLs (the reflect keyword).
The device does not apply MAC-based ACLs on IPv6 frames.
When configuring an ACL, there is no restriction on keywords entered in the ACL, regardless of whether or not they are supported on the platform. When you apply the ACL to an interface that requires hardware forwarding (physical ports or SVIs), the device checks to determine whether or not the ACL can be supported on the interface. If not, attaching the ACL is rejected.
If an ACL is applied to an interface and you attempt to add an access control entry (ACE) with an unsupported keyword, the device does not allow the ACE to be added to the ACL that is currently attached to the interface
An access control list (ACL) is a set of rules used to limit access to a particular interface. ACLs are configured on the device and applied to the management interface and to any of the dynamic interfaces.
You can also create a preauthentication ACL for web authentication. Such an ACL is used to allow certain types of traffic before authentication is complete.
IPv6 ACLs support the same options as IPv4 ACLs including source, destination, source and destination ports.
Note |
You can enable only IPv4 traffic in your network by blocking IPv6 traffic. That is, you can configure an IPv6 ACL to deny all IPv6 traffic and apply it on specific or all WLANs. |
Types of ACL
For the per-user ACL, the full access control entries (ACE) as the text strings are configured on the ACS.
For the filter-Id ACL,
the full ACEs and the
acl
name(filter-id)
is configured on the
device
and only the
filter-id
is configured on the
ACS.
The stack master supports IPv6 ACLs in hardware and distributes the IPv6 ACLs to the stack members.
If a new switch takes over as stack master, it distributes the ACL configuration to all stack members. The member switches sync up the configuration distributed by the new stack master and flush out entries that member switches sync up the configuration distributed by the new stack master and flush out entries that are not required.
When an ACL is modified, attached to, or detached from an interface, the stack master distributes the change to all stack members.
To filter IPv6 traffic, you perform these steps:
Before configuring IPv6 ACLs, you must select one of the dual IPv4 and IPv6 SDM templates.
Command or Action | Purpose | |
---|---|---|
Step 1 |
Create an IPv6 ACL, and enter IPv6 access list configuration mode. |
|
Step 2 |
Configure the IPv6 ACL to block (deny) or pass (permit) traffic. |
|
Step 3 |
Apply the IPv6 ACL to the interface where the traffic needs to be filtered. |
|
Step 4 |
Apply the IPv6 ACL to an interface. For router ACLs, you must also configure an IPv6 address on the Layer 3 interface to which the ACL is applied. |
There are no IPv6 ACLs configured or applied.
If an IPv6 router ACL is configured to deny a packet, the packet is not routed. A copy of the packet is sent to the Internet Control Message Protocol (ICMP) queue to generate an ICMP unreachable message for the frame.
If a bridged frame is to be dropped due to a port ACL, the frame is not bridged.
You can create both IPv4 and IPv6 ACLs on a switch or switch stack, and you can apply both IPv4 and IPv6 ACLs to the same interface. Each ACL must have a unique name; an error message appears if you try to use a name that is already configured.
You use different commands to create IPv4 and IPv6 ACLs and to attach IPv4 or IPv6 ACLs to the same Layer 2 or Layer 3 interface. If you use the wrong command to attach an ACL (for example, an IPv4 command to attach an IPv6 ACL), you receive an error message.
If the hardware memory is full, for any additional configured ACLs, packets are dropped to the CPU, and the ACLs are applied in software. When the hardware is full a message is printed to the console indicating the ACL has been unloaded and the packets will be dropped on the interface.
How To Configure an IPv6 ACL
Beginning in privileged EXEC mode, follow these steps to create an IPv6 ACL:
Command or Action | Purpose | |
---|---|---|
Step 1 |
configure terminal Example:
|
Enters global configuration mode. |
Step 2 |
ipv6 access-list acl_name Example:
|
Use a name to define an IPv6 access list and enter IPv6 access-list configuration mode. |
Step 3 |
{deny|permit} protocol Example:
|
If the operator follows the source-ipv6-prefix/prefix-length argument, it must match the source port. If the operator follows the destination-ipv6- prefix/prefix-length argument, it must match the destination port.
|
Step 4 |
{deny|permit} tcp Example:
|
(Optional) Define a TCP access list and the access conditions.
|
Step 5 |
{deny|permit} udp Example:
|
(Optional) Define a UDP access list and the access conditions. Enter udp for the User Datagram Protocol. The UDP parameters are the same as those described for TCP, except that the operator [port]] port number or name must be a UDP port number or name, and the established parameter is not valid for UDP. |
Step 6 |
{deny|permit} icmp Example:
|
(Optional) Define an ICMP access list and the access conditions.
|
Step 7 |
end Example:
|
Returns to privileged EXEC mode. Alternatively, you can also press Ctrl-Z to exit global configuration mode. |
Step 8 |
show ipv6 access-list Example:
|
Verify the access list configuration. |
Step 9 |
copy running-config startup-config Example:
|
(Optional) Save your entries in the configuration file. |
This section describes how to apply IPv6 ACLs to network interfaces. You can apply an IPv6 ACL to outbound or inbound traffic on layer 2 and Layer 3 interfaces. You can apply IPv6 ACLs only to inbound management traffic on Layer 3 interfaces.
Beginning in privileged EXEC mode, follow these steps to control access to an interface:
Command or Action | Purpose | |||
---|---|---|---|---|
Step 1 |
configure terminal Example:
|
Enters global configuration mode. |
||
Step 2 |
interface interface_id Example:
|
Identifies a Layer 2 interface (for port ACLs) or Layer 3 Switch Virtual interface (for router ACLs) on which to apply an access list, and enters interface configuration mode. |
||
Step 3 |
no switchport Example:
|
Changes the interface from Layer 2 mode (the default) to Layer 3 mode (only if applying a router ACL). |
||
Step 4 |
ipv6 address ipv6_address Example:
|
|
||
Step 5 |
ipv6 traffic-filter acl_name Example:
|
Applies the access list to incoming or outgoing traffic on the interface. |
||
Step 6 |
end Example:
|
Returns to privileged EXEC mode. Alternatively, you can also press Ctrl-Z to exit global configuration mode. |
||
Step 7 |
show running-config interface tenGigabitEthernet 1/0/3 Example:
|
Shows the configuration summary. |
||
Step 8 |
copy running-config startup-config Example:
|
(Optional) Saves your entries in the configuration file. |
You can display information about all configured access lists, all IPv6 access lists, or a specific access list by using one or more of the privileged EXEC commands.
Command or Action | Purpose | |
---|---|---|
Step 1 |
show access-list Example:
|
Displays all access lists configured on the device |
Step 2 |
show ipv6 access-list acl_name Example:
|
Displays all configured IPv6 access list or the access list specified by name. |
Configuration Examples for IPv6 ACL
Note |
Logging is supported only on Layer 3 interfaces. |
Device(config)# ipv6 access-list CISCO
Device(config-ipv6-acl)# deny tcp any any gt 5000
Device (config-ipv6-acl)# deny ::/0 lt 5000 ::/0 log
Device(config-ipv6-acl)# permit icmp any any
Device(config-ipv6-acl)# permit any any
Device(config)# interface TenGigabitEthernet 1/0/3
Device(config-if)# no switchport
Device(config-if)# ipv6 address 2001::/64 eui-64
Device(config-if)# ipv6 traffic-filter CISCO out
Device #show access-lists
Extended IP access list hello
10 permit ip any any
IPv6 access list ipv6
permit ipv6 any any sequence 10
Device# show ipv6 access-list
IPv6 access list inbound
permit tcp any any eq bgp (8 matches) sequence 10
permit tcp any any eq telnet (15 matches) sequence 20
permit udp any any sequence 30
IPv6 access list outbound
deny udp any any sequence 10
deny tcp any any eq telnet sequence 20
Command or Action | Purpose | |
---|---|---|
Step 1 |
ipv6 nd raguard policy MyPloicy Example:
|
|
Step 2 |
trusted-port Example:
|
Configures the trusted port for the policy created above. |
Step 3 |
device-role router Example:
|
Defines the trusted device that can send RAs to the trusted port created above. |
Step 4 |
interface tenGigabitEthernet 1/0/1 Example:
|
Configures the interface to the trusted device. |
Step 5 |
ipv6 nd raguard attach-policy MyPolicy Example:
|
Configures and attaches the policy to trust the RA's received from the port. |
Step 6 |
vlan configuration 19-21,23 Example:
|
Configures the wireless client vlans. |
Step 7 |
ipv6 nd suppress Example:
|
Suppresses the ND messages over wireless. |
Step 8 |
ipv6 snooping Example:
|
Captures IPv6 traffic. |
Step 9 |
ipv6 nd raguard attach-policy MyPolicy Example:
|
Attaches the RA Guard policy to the wireless client vlans. |
Step 10 |
ipv6 nd ra-throttler attach-policy Mythrottle Example:
|
Attaches the RA throttling policy to the wireless client vlans. |
Command or Action | Purpose |
---|---|
ipv6 neighbor binding [vlan ] 19 2001:db8::25:4 interface tenGigabitEthernet 1/0/3 aaa.bbb.ccc Example:
|
Sets and validates the neighbor 2001:db8::25: 4 only valid when transmitting on VLAN 19 through interface te1/0/3 with the source mac-address as aaa.bbb.ccc. |
Description | Link |
---|---|
To help you research and resolve system error messages in this release, use the Error Message Decoder tool. |
https://www.cisco.com/cgi-bin/Support/Errordecoder/index.cgi |
MIB | MIBs Link |
---|---|
All the supported MIBs for this release. |
To locate and download MIBs for selected platforms, Cisco IOS releases, and feature sets, use Cisco MIB Locator found at the following URL: |
Description | Link |
---|---|
The Cisco Support website provides extensive online resources, including documentation and tools for troubleshooting and resolving technical issues with Cisco products and technologies. To receive security and technical information about your products, you can subscribe to various services, such as the Product Alert Tool (accessed from Field Notices), the Cisco Technical Services Newsletter, and Really Simple Syndication (RSS) Feeds. Access to most tools on the Cisco Support website requires a Cisco.com user ID and password. |
Feature |
Release |
Modification |
---|---|---|
IPv6 ACL Functionality |
Cisco IOS XE Everest 16.6.1 |
This feature was introduced. |