Cisco Catalyst 9800 Series Wireless Controller Software Configuration Guide, Cisco IOS XE 26.1.x

PDF

Cisco Catalyst 9800 Series Wireless Controller Software Configuration Guide, Cisco IOS XE 26.1.x

IPv6 ACL

Updated: April 10, 2026

Want to summarize with AI?

Log in

Introduces IPv6 access control lists (ACLs), describing their purpose, configuration, and how they compare to IPv4 ACLs in managing network access and data traffic.

An access control list (ACL) is a set of rules used to control or restrict access to a network interface that

  • are configured on the device and can be applied to various interfaces such as the management interface, AP-manager interface, dynamic interfaces, or on WLANs, and

  • regulate data traffic to and from wireless clients or to protect the controller’s central processing unit (CPU).

You can also create a preauthentication ACL for web authentication. Such an ACL is used to allow certain types of traffic before authentication is complete.

IPv6 ACLs support the same options as IPv4 ACLs including source, destination, source and destination ports.

Note

To enable only IPv4 traffic in your network, block all IPv6 traffic. Configure an IPv6 ACL to deny all IPv6 traffic, and apply it to specific WLANs or to all WLANs.

Understand IPv6 ACLs

Types of ACL

Per user IPv6 ACL

  • For the per-user ACL, the complete access control entries (ACEs) are configured as text strings on the RADIUS server.

  • The ACCESS-Accept attribute contains the ACE, which is then sent to the device and applied directly to the client. When a wireless client roams to a foreign device, the foreign device receives the ACEs as an AAA attribute in the mobility handoff message. Output direction using per-user ACL is not supported.

Filter ID IPv6 ACL

  • For the filter-Id ACL, the complete ACEs and the ACL name filter-id are configured on the Cisco 9800 controller. Only the filter-id is configured on the RADIUS server.

  • The filter-id is sent to the device in the ACCESS-Accept attribute. The device looks up the filter-id to find the ACEs, and then applies the ACEs to the client. When the client roams at Layer 2 to the foreign device, only the filter-id is sent to the foreign device in the mobility handoff message. Using output filtered ACLs with per-user ACLs is not supported.

Prerequisites for configuring IPv6 ACL

  • To filter IP Version 6 (IPv6) traffic, create IPv6 access control lists (ACLs) and apply them to interfaces, using the same process as for IP Version 4 (IPv4) named ACLs.

  • You can also create and apply input router ACLs to filter Layer 3 management traffic when the switch is running the Network Essentials license.

Restrictions for configuring IPv6 ACL

With IPv4, you can configure standard and extended numbered IP ACLs, named IP ACLs, and MAC ACLs. IPv6 supports only named ACLs. The IPv6 ACL does not support FlexConnect mode.
The device supports most of the Cisco IOS-supported IPv6 ACLs, with some exceptions:

  • The controller does not support routing, and only inbound ACLs are supported for wireless clients.

  • The device does not support matching on these keywords: flowlabel, routing header, and undetermined-transport.

  • The device does not support reflexive ACLs (the reflect keyword).

  • The device does not apply MAC-based ACLs on IPv6 frames.

  • There is no restriction on the keywords entered in the ACL, even if they are not supported on the platform. When you apply the ACL to an interface that requires hardware forwarding (physical ports or SVIs), the device checks if the ACL is supported on the interface. If not, attaching the ACL is rejected.

  • If not, the device rejects attaching the ACL. If an ACL is already applied to an interface and you attempt to add an access control entry (ACE) with an unsupported keyword, the device does not allow the ACE to be added to the ACL currently attached to the interface.