Configure IPv6 ACLs | IPv6 ACL | Cisco Catalyst 9800 Series Wireless Controller Software Configuration Guide, Cisco IOS XE 26.x

Use this task to filter IPv6 traffic by configuring and applying IPv6 access control lists (ACLs) to router interfaces.

Block or permit IPv6 traffic based on policies using ACLs.

To filter IPv6 traffic, perform these steps:

Before you begin

Procedure

Create an IPv6 ACL, and enter the IPv6 access list configuration mode.
Configure the IPv6 ACL to block (deny) or pass (permit) traffic.
Apply the IPv6 ACL to the interface where traffic will be filtered.
For router ACLs, assign an IPv6 address to the Layer 3 interface where the ACL is applied.

Default IPv6 ACL configuration

There are no IPv6 ACLs configured or applied.

Interact with other features and switches

Access control lists (ACLs) on switches interact with other features and platform behaviors in these ways:

If a port ACL is configured to drop a bridged frame, the frame is not bridged.
You can create IPv4 and IPv6 ACLs, and apply both to the same interface.
Each ACL must have a unique name; if not, you receive an error message.
Different commands are required to create and attach IPv4 and IPv6 ACLs. Using the incorrect command results in an error.
MAC ACLs cannot filter IPv6 frames; MAC ACLs are for non-IP frames.
When hardware memory or TCAM is full, additional ACLs are processed in software by the CPU. A console message indicates the ACL has been unloaded and packets will be handled in software.
Only packets matching the ACL type (IPv4, IPv6, or MAC) that could not be added will be processed in software.
If the TCAM is full, additional configured ACLs result in packets being forwarded to the CPU, and the ACLs are applied in software.

Create an IPv6 ACL (GUI)

Define and apply an IPv6 ACL to control permitted or denied network traffic based on source, destination, protocol, and other parameters using the GUI.

Procedure

Choose Configuration > Security > ACL.
Click Add.
In the Add ACL Setup dialog box, enter these parameters.
- ACL Name: Enter the name for the ACL
- ACL Type: IPv6
- Sequence: The valid range is between 100 and 199 or 2000 and 26991.
- Action: Select Permit or Deny the packet flow from the drop-down list.
- Source Type: Choose any, Host or Network from which the packet is sent.
- Destination Type: Choose any, Host or Network to which the packet is sent.
- Protocol: Select a protocol from the drop-down list.
- Log: Enable or disable logging.
- DSCP: Enter to match packets with the DSCP value.
Click Add.
Add the rest of the rules and click Apply to Device.

Create an IPv6 ACL (CLI)

Define rules to permit or deny IPv6 packets based on specific criteria, enhancing network security and control using commands.

Procedure

Enable the privileged EXEC mode and enter the global configuration mode.
Example:
```
Device# enable
```
```
Device# configure terminal
```
Enter your password if prompted.
Use a name to define an IPv6 access list and enter the IPv6 access-list configuration mode.
Example:
```
Device# ipv6 access-list acl_name
```
Enter deny or permit to specify whether to deny or permit the packet if conditions are matched.
Example:
```
{deny | permit} protocol {source-ipv6-prefix/prefix-length | any | host source-ipv6-address}
[operator [port-number]]{destination-ipv6-prefix/prefix-length | any |host destination-ipv6-address}
[operator [port-number]][dscp value] [fragments][log] [log-input] [routing][sequence value]
[time-range name]
```
These are the conditions:
- To set the protocol, enter the name or number of an Internet protocol (ahp, esp, icmp, ipv6, pcp, stcp, tcp, or udp), or enter an integer from 0 to 255 to represent an IPv6 protocol number.
- Specify the source-ipv6-prefix/prefix-length or destination-ipv6-prefix/prefix-length as the source or destination IPv6 network or network class to set deny or permit conditions. Enter values in hexadecimal, using 16-bit segments separated by colons, as described in RFC 2373.
- Enter any as an abbreviation for the IPv6 prefix ::/0.
- For host source-ipv6-address or destination-ipv6-address, enter the specific IPv6 host address. Enter values in hexadecimal, using 16-bit segments separated by colons, to set deny or permit conditions.
- Specify an operator to compare the source or destination ports of the protocol. Valid operators are lt (less than), gt (greater than), eq (equal), neq (not equal), and range.
When the operator is placed after the source-ipv6-prefix/prefix-length argument, it matches the source port. When the operator is placed after the destination-ipv6-prefix/prefix-length argument, it matches the destination port.
- The port number can be a decimal value from 0 to 65535 or a TCP or UDP port name. Use TCP port names only for TCP filtering, and UDP port names only for UDP filtering.
- Enter a DSCP value to match a differentiated services code point against the traffic class value in each IPv6 packet header. The valid range is 0 to 63.
- To check noninitial fragments, enter the keyword fragments. This option is available only when the protocol is IPv6.
- To send a log message to the console for matching packets, enter log. To include the input interface in the log entry, enter log-input. Logging is supported only for router ACLs.
- Enter routing to enable IPv6 packet routing.
- Enter a sequence value to assign a sequence number to the access list statement. Valid values range from 1 to 4,294,967,295.
- Enter a time-range name to apply a specific time range to the deny or permit statement.
Define a TCP access list and the access conditions.
Example:
```
{deny | permit} tcp {source-ipv6-prefix/prefix-length | any | hostsource-ipv6-address}
[operator [port-number]]{destination-ipv6-prefix/prefix-length | any |hostdestination-ipv6-address}
[operator [port-number]][ack] [dscp value][established] [fin] 
[log][log-input] [neq {port |protocol}] [psh] [range{port | protocol}] [rst][routing] [sequence value]
[syn] [time-range name][urg]
```
Enter tcp for Transmission Control Protocol. The parameters are the same as those described in Step 3, with these additional optional parameters:
- ack: Acknowledgment bit set.
- established: An established connection. A match occurs if the TCP datagram has the ACK or RST bits set.
- fin: Finished bit set; no more data from sender.
- neq {port | protocol}: Matches only packets that are not on a given port number.
- psh: Push function bit set.
- range {port | protocol}: Matches only packets in the port number range.
- rst: Reset bit set.
- syn: Synchronize bit set.
- urg: Urgent pointer bit set.

Define a UDP access list and the access conditions.

Example:

{deny | permit} udp {source-ipv6-prefix/prefix-length | any | hostsource-ipv6-address}
[operator [port-number]]{destination-ipv6-prefix/prefix-length | any | hostdestination-ipv6-address}
[operator [port-number]][dscp value] [log][log-input] 
[neq {port |protocol}] [range {port |protocol}] [routing][sequence value][time-range name]

Enter udp for the User Datagram Protocol. The UDP parameters are similar to those for TCP. However, the operator [port] must specify a UDP port number or name, and the established parameter cannot be used with UDP.

Define an ICMP access list and the access conditions.
Example:
```
{deny | permit} icmp {source-ipv6-prefix/prefix-length | any | hostsource-ipv6-address}
[operator [port-number]] {destination-ipv6-prefix/prefix-length | any | hostdestination-ipv6-address}
[operator [port-number]][icmp-type [icmp-code] |icmp-message] [dscpvalue] [log] [log-input]
[routing] [sequence value][time-range name]
```
Enter icmp for Internet Control Message Protocol. The ICMP parameters are the same as those for most IP protocols in Step 3a. However, ICMP includes additional parameters for message type and code. These optional keywords have these meanings:
- icmp-type: Enter to filter by ICMP message type, a number from 0 to 255.
- icmp-code: Enter to filter ICMP packets by the ICMP message code type, a number from 0 to 255.
- icmp-message: Enter to filter ICMP packets by the ICMP message type name or the ICMP message type and code name. To view a list of ICMP message type names and code names, use the ? key or consult the command reference for this release.
Returns to privileged EXEC mode. Alternatively, you can also press Ctrl-Z to exit global configuration mode.
Example:
```
Device(config)# end
```
Verify the access list configuration.
Example:
```
show ipv6 access-list
```
Save your entries in the configuration file.
Example:
```
copy running-config startup-config
```

Create WLAN IPv6 ACL (GUI)

Create a WLAN IPv6 Access Control List (ACL) using the GUI to apply IPv6 traffic controls to a wireless LAN.

Procedure

Choose Configuration > Tags & Profiles > WLANs.
Click Add.
In the General tab, enter the Profile Name , the SSID and the WLAN ID.
Choose Security > Layer3 tab. Click Show Advanced Settings. Under the Preauthenticated ACL settings, select the ACL from the IPv6 drop-down list.
Click Apply to Device.

Create WLAN IPv6 ACL (CLI)

Create and apply a WLAN IPv6 Access Control List (ACL) to define traffic rules and enforce security for wireless clients using commands.

Procedure

Enter the global configuration mode.
Example:
```
Device# configure terminal
```
Create policy profile for the WLAN.
Example:
```
Device(config)# wireless profile policy profile-name
```
The profile-name is the profile name of the policy profile.

Create a named WLAN ACL.

Example:

Device(config-wireless-policy)# ipv6 acl acl_name

Create a pre-authentication ACL for web authentication.
Example:
```
Device(config-wlan)# ipv6 traffic-filter web acl_name-preauth
```