	1.	Enable the privileged EXEC mode. Example: `Device# enable` Enter your password if prompted.
	2.	Enter the global configuration mode. Example: `Device# configure terminal`
	3.	Display all access lists configured on the device Example: `Device# show access-lists`
	4.	Display all configured IPv6 access list or the access list specified by name. Example: `Device# show ipv6 access-list acl_name`

Example: Create an IPv6 ACL

This example configures the IPv6 access list named CISCO. The first deny entry denies all packets with a destination TCP port number greater than 5000. The second deny entry denies packets with a source UDP port number less than 5000. The second deny entry also logs all matches to the console. The first permit entry permits all ICMP packets. The second permit entry permits all other traffic. The second permit entry is necessary because each IPv6 access list ends with an implicit deny all condition.

Note
Logging is supported only on Layer 3 interfaces.


Device(config)# ipv6 access-list CISCO
Device(config-ipv6-acl)# deny tcp any any gt 5000
Device(config-ipv6-acl)# deny ::/0 lt 5000 ::/0 log
Device(config-ipv6-acl)# permit icmp any any
Device(config-ipv6-acl)# permit any any

Example: Apply an IPv6 ACL to a policy profile in a wireless environment

These example shows how to apply an IPv6 ACL to a policy profile in a wireless environment.

Note

All IPv6 ACLs must be associated to a policy profile.

Create an IPv6 ACL.


Device
                            (config)# ipv6 access-list <acl-name>                       
Device
                            (config-ipv6-acl)# permit tcp 2001:DB8::/32 any                        
Device
                            (config-ipv6-acl)# permit udp 2001:DB8::/32 any

Apply the IPv6 ACL to a policy profile.


Device
                            (config)# wireless profile policy <policy-profile-name>                        
Device
                            (config-wireless-policy)# shutdown                       
Device
                            (config-wireless-policy)# ipv6 acl <acl-name>                        
Device
                        (config-wireless-policy)# no shutdown

Display IPv6 ACLs (CLI)

This topic shows you how to display all configured IPv6 access control lists (ACLs) or a specific ACL by using commands on your device.

To display IPv6 ACLs, perform this procedure:

Procedure

	1.	Display all access lists configured on the device. Example: `Device# show access-lists`
	2.	Display all configured IPv6 access list or the access list specified by name. Example: `Device# show ipv6 access-list acl_name`

Example: Display IPv6 ACLs

This is an example of the output from the show access-lists privileged EXEC command. The output shows all access lists that are configured on the switch or switch stack .


Device# show access-lists
Extended IP access list hello
10 permit ip any any
IPv6 access list ipv6
permit ipv6 any any sequence 10

This is an example of the output from the show ipv6 access-lists privileged EXEC command. The output shows only IPv6 access lists configured on the switch or switch stack.


Device# show ipv6 access-list
IPv6 access list inbound
permit tcp any any eq bgp (8 matches) sequence 10
permit tcp any any eq telnet (15 matches) sequence 20
permit udp any any sequence 30
IPv6 access list outbound
deny udp any any sequence 10
deny tcp any any eq telnet sequence 20

Example: Configure RA throttling

Configure router advertisement (RA) throttling and neighbor solicitation (NS) suppression to prevent power-saving wireless clients from being disturbed by frequent unsolicited RA messages using commands.

This task describes how to create an RA throttle policy in order to help the power-saving wireless clients from being disturbed by frequent unsolicited periodic RA's. The unsolicited multicast RA is throttled by the controller .

Before you begin

Enable IPv6 on the client machine.

Procedure

	1.	Enter the global configuration mode. Example: `Device# configure terminal`
	2.	Create a RA throttler policy called Mythrottle. Example: `Device(config)# ipv6 nd ra-throttler policy Mythrottle`
	3.	Determine the time interval segment during which throttling applies. Example: `Device(config-nd-ra-throttle)# throttle-period 20`
	4.	Determine how many initial RA's are allowed. Example: `Device(config-nd-ra-throttle)# max-through 5`
	5.	Determine how many RA's are allowed after the initial RAs have been transmitted, until the end of the interval segment. Example: `Device(config-nd-ra-throttle)# allow at-least 3 at-most 5`
	6.	Create a per VLAN configuration. Example: `Device(config)# vlan configuration 100`
	7.	Enable the router advertisement throttling. Example: `Device(config)# ipv6 nd ra-throttle attach-policy attach-policy_name`
	8.	Return to privileged EXEC mode. Alternatively, you can also press Ctrl-Z to exit global configuration mode. Example: `Device(config)# end`

Need help?

Open a support case

(Requires a Cisco Service Contract)

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.