1.

configure terminal

Enter global configuration mode.

2.

ipv6 access-list access-list-name

Define an IPv6 access list using a name, and enter IPv6 access-list configuration mode.

3. a

{ deny | permit } protocol
{ source-ipv6-prefix / prefix-length | any | host source-ipv6-address } [ operator [ port-number ]] { destination-ipv6-prefix/ prefix-length | any |
host destination-ipv6-address } [ operator [ port-number ]]
[ dscp value ] [ fragments ] [ log ] [ log-input ] [ routing ] [ sequence value ] [ time-range name ]

Deny or permit the packet, when specified conditions are matched. These are the conditions:

■ protocol –Name or number of an Internet protocol: ahp, esp, icmp, ipv6, pcp, stcp, tcp, or udp, or an integer in the range 0 to 255 representing an IPv6 protocol number. For additional specific parameters for ICMP, TCP, and UDP, see Steps 3b through 3d.

■ source-ipv6-prefix / prefix-length or destination-ipv6-prefix / prefix-length– Source or destination IPv6 network or class of networks for which to set deny or permit conditions, specified in hexadecimal and using 16-bit values between colons.

■Enter any as an abbreviation for the IPv6 prefix ::/0.

■ host source-ipv6-address o r destination-ipv6-address– Define source or destination IPv6 host address for which to set deny or permit conditions, specified in hexadecimal and using 16-bit values between colons.

■(Optional) operator –Operand that compares the source or destination ports of the specified protocol such as
lt (less than), gt (greater than), eq (equal), neq (not equal), and range.

If the operator follows the source-ipv6-prefix / prefix-length argument, it must match the source port. If the operator follows the destination-ipv6- prefix/prefix-length argument, it must match the destination port.

■(Optional) port-number– Value of 0 to 65535 or TCP or UDP port name. Use TCP port names only when filtering TCP. Use UDP port names only when filtering UDP.

■(Optional) dscp value –Match a differentiated services code point value against the traffic class value in the Traffic Class field of each IPv6 packet header. The acceptable range is from 0 to 63.

■(Optional) fragments– Check noninitial fragments. Keyword is only visible when the protocol is ipv6.

■(Optional, router ACLs only) log– Send a logging message to the console about the packet that matches the entry. Enter log-input to include the input interface in the log entry.

■(Optional) routing –Specify routing of IPv6 packets.

■(Optional) sequence value –Specify the sequence number for the access list statement. Value range is from 1 to 4294967295.

■(Optional) time-range name– Specify the time range that applies to the deny or permit statement.

Step 3b

{ deny | permit } tcp { source-ipv6-prefix / prefix-length | any | host source-ipv6-address } [ operator [ port-number ]] { destination-ipv6- prefix/prefix-length | any | host destination-ipv6-address } [ operator [ port-number ]] [ ack ] [ dscp value ] [ established ] [ fin ] [ log ] [ log-input ] [ neq { port | protocol }] [ psh ] [ range { port | protocol }] [ rst ] [ routing ] [ sequence value ] [ syn ] [ time-range name ] [ urg ]

(Optional) Define a TCP access list and the access conditions.

Enter tcp for Transmission Control Protocol. The parameters are the same as those described in Step 3a, with these additional optional parameters:

■ ack — Acknowledgment bit set.

■ established — An established connection. A match occurs if the TCP datagram has the ACK or RST bits set.

■ fin — Finished bit set; no more data from sender.

■ neq { port | protocol } — Match only packets that are not on a given port number.

■ psh — Push function bit set.

■ range { port | protocol }— Match only packets in the port number range.

■ rst — Reset bit set.

■ syn — Synchronize bit set.

■ urg — Urgent pointer bit set.

Step 3c

{ deny | permit } udp
{ source-ipv6-prefix / prefix-length | any | host source-ipv6-address } [ operator [ port-number ]] { destination-ipv6-prefix/prefix-length | any | host destination-ipv6-address } [ operator [ port-number ]] [ dscp value ] [log ] [log-input] [ neq { port | protocol }] [ range { port | protocol }] [ routing ] [ sequence value ] [ time-range name ]

(Optional) Define a UDP access list and the access conditions.

Enter udp for the User Datagram Protocol. The UDP parameters are the same as those described for TCP, except that the [ operator [ port ]] port number or name must be a UDP port number or name, and the established parameter is not valid for UDP.

Step 3d

{ deny | permit } icmp { source-ipv6-prefix / prefix-length | any | host source-ipv6-address } [ operator [ port-number ]] { destination-ipv6-prefix/prefix-length | any | host destination-ipv6-address } [ operator [ port-number ]] [ icmp-type [ icmp-code ] | icmp-message ] [ dscp value ] [ log ] [ log-input ] [ routing ] [ sequence value ] [ time-range name ]

(Optional) Define an ICMP access list and the access conditions.

Enter icmp for Internet Control Message Protocol. The ICMP parameters are the same as those described for most IP protocols in Step 3a, with the addition of the ICMP message type and code parameters. These optional keywords have these meanings:

■ icmp-type —Enter to filter by ICMP message type, a number from 0 to 255.

■ icmp-code —Enter to filter ICMP packets that are filtered by the ICMP message code type, a number from 0 to 255.

■ icmp-message —Enter to filter ICMP packets by the ICMP message type name or the ICMP message type and code name. To see a list of ICMP message type names and code names, use the ? key.

4.

end

Return to privileged EXEC mode.

5.

show ipv6 access-list

Verify the access list configuration.

6.

copy running-config startup-config

(Optional) Save your entries in the configuration file.

1.

configure terminal

Enter global configuration mode.

2.

interface interface-id

Identify a Layer 2 interface (for port ACLs) or Layer 3 interface (for router ACLs) on which to apply an access list, and enter interface configuration mode.

3.

no switchport

If applying a router ACL, change the interface from Layer 2 mode (the default) to Layer 3 mode.

4.

ipv6 address ipv6-address

Configure an IPv6 address on a Layer 3 interface (for router ACLs).

Note: This command is not required on Layer 2 interfaces or if the interface is already configured with an explicit IPv6 address.

Use the no ipv6 traffic-filter access-list-name interface configuration command to remove an access list from an interface.

5.

ipv6 traffic-filter access-list-name { in | out }

Apply the access list to incoming or outgoing traffic on the interface.

Note: The out keyword is not supported for Layer 2 interfaces (port ACLs).

6.

end

Return to privileged EXEC mode.

7.

show running-config

Verify the access list configuration.

8.

copy running-config startup-config

(Optional) Save your entries in the configuration file.