|
1. |
Enable the privileged EXEC mode and enter the global configuration mode.
Example:
Device# enable
Device# configure terminal
Enter your password if prompted.
|
|
2. |
Use a name to define an IPv6 access list and enter the IPv6 access-list configuration mode.
Example:
Device# ipv6 access-list acl_name
|
|
3. |
Enter deny or permit to specify whether to deny or permit the packet if conditions are matched.
Example:
{deny | permit} protocol {source-ipv6-prefix/prefix-length | any | host source-ipv6-address}
[operator [port-number]]{destination-ipv6-prefix/prefix-length | any |host destination-ipv6-address}
[operator [port-number]][dscp value] [fragments][log] [log-input] [routing][sequence value]
[time-range name]
These are the conditions:
-
To set the protocol, enter the name or number of an Internet protocol (ahp, esp, icmp, ipv6, pcp, stcp, tcp, or udp), or enter an integer from 0 to 255 to represent an IPv6 protocol number.
-
Specify the source-ipv6-prefix/prefix-length or destination-ipv6-prefix/prefix-length as the source or destination IPv6 network or network class to set deny or permit conditions. Enter values in hexadecimal, using 16-bit segments separated by colons, as described in RFC 2373.
-
Enter any as an abbreviation for the IPv6 prefix ::/0.
-
For host source-ipv6-address or destination-ipv6-address, enter the specific IPv6 host address. Enter values in hexadecimal, using 16-bit segments separated by colons, to set deny or permit conditions.
-
Specify an operator to compare the source or destination ports of the protocol. Valid operators are lt (less than), gt (greater than), eq (equal), neq (not equal), and range.
When the operator is placed after the source-ipv6-prefix/prefix-length argument, it matches the source port. When the operator is placed after the destination-ipv6-prefix/prefix-length argument, it matches the destination port.
-
The port number can be a decimal value from 0 to 65535 or a TCP or UDP port name. Use TCP port names only for TCP filtering, and UDP port names only for UDP filtering.
-
Enter a DSCP value to match a differentiated services code point against the traffic class value in each IPv6 packet header. The valid range is 0 to 63.
-
To check noninitial fragments, enter the keyword fragments. This option is available only when the protocol is IPv6.
-
To send a log message to the console for matching packets, enter log. To include the input interface in the log entry, enter log-input. Logging is supported only for router ACLs.
-
Enter routing to enable IPv6 packet routing.
-
Enter a sequence value to assign a sequence number to the access list statement. Valid values range from 1 to 4,294,967,295.
-
Enter a time-range name to apply a specific time range to the deny or permit statement.
|
|
4. |
Define a TCP access list and the access conditions.
Example:
{deny | permit} tcp {source-ipv6-prefix/prefix-length | any | hostsource-ipv6-address}
[operator [port-number]]{destination-ipv6-prefix/prefix-length | any |hostdestination-ipv6-address}
[operator [port-number]][ack] [dscp value][established] [fin]
[log][log-input] [neq {port |protocol}] [psh] [range{port | protocol}] [rst][routing] [sequence value]
[syn] [time-range name][urg]
Enter tcp for Transmission Control Protocol. The parameters are the same as those described in Step 3, with these additional optional parameters:
-
ack: Acknowledgment bit set.
-
established: An established connection. A match occurs if the TCP datagram has the ACK or RST bits set.
-
fin: Finished bit set; no more data from sender.
-
neq {port | protocol}: Matches only packets that are not on a given port number.
-
psh: Push function bit set.
-
range {port | protocol}: Matches only packets in the port number range.
-
rst: Reset bit set.
-
syn: Synchronize bit set.
-
urg: Urgent pointer bit set.
|
|
5. |
Define a UDP access list and the access conditions.
Example:
{deny | permit} udp {source-ipv6-prefix/prefix-length | any | hostsource-ipv6-address}
[operator [port-number]]{destination-ipv6-prefix/prefix-length | any | hostdestination-ipv6-address}
[operator [port-number]][dscp value] [log][log-input]
[neq {port |protocol}] [range {port |protocol}] [routing][sequence value][time-range name]
Enter udp for the User Datagram Protocol. The UDP parameters are similar to those for TCP. However, the operator [port] must specify a UDP port number or name, and the established parameter cannot be used with UDP.
|
|
6. |
Define an ICMP access list and the access conditions.
Example:
{deny | permit} icmp {source-ipv6-prefix/prefix-length | any | hostsource-ipv6-address}
[operator [port-number]] {destination-ipv6-prefix/prefix-length | any | hostdestination-ipv6-address}
[operator [port-number]][icmp-type [icmp-code] |icmp-message] [dscpvalue] [log] [log-input]
[routing] [sequence value][time-range name]
Enter icmp for Internet Control Message Protocol. The ICMP parameters are the same as those for most IP protocols in Step 3a. However, ICMP includes additional parameters for message type and code. These optional keywords have these meanings:
-
icmp-type: Enter to filter by ICMP message type, a number from 0 to 255.
-
icmp-code: Enter to filter ICMP packets by the ICMP message code type, a number from 0 to 255.
-
icmp-message: Enter to filter ICMP packets by the ICMP message type name or the ICMP message type and code name. To view a list of ICMP message type names and code names, use the ? key or consult the command reference for this release.
|
|
7. |
Returns to privileged EXEC mode. Alternatively, you can also press Ctrl-Z to exit global configuration mode.
Example:
Device(config)# end
|
|
8. |
Verify the access list configuration.
Example:
show ipv6 access-list
|
|
9. |
(Optional) Save your entries in the configuration file.
Example:
copy running-config startup-config
|