Default Configuration For Ipv6 Acls; How To Configure Ipv6 Acls - Cisco Catalyst 2960-XR Security Configuration Manual

Configuring IPv6 ACLs
• You cannot apply IPv6 port ACLs to Layer 2 EtherChannels.
• When configuring an ACL, there is no restriction on keywords entered in the ACL, regardless of whether
• If an ACL is applied to an interface and you attempt to add an access control entry (ACE) with an
IPv6 ACLs on the switch have these characteristics:
• Fragmented frames (the fragments keyword as in IPv4) are supported
• The same statistics supported in IPv4 are supported for IPv6 ACLs.
• If the switch runs out of hardware space, the packets associated with the ACL are dropped on the interface.
• Logging is supported for router ACLs, but not for port ACLs.
• The switch supports IPv6 address-matching for a full range of prefix-lengths.

Default Configuration for IPv6 ACLs

The default IPv6 ACL configuration is as follows:
Switch# show access-lists preauth_ipv6_acl
IPv6 access list preauth_ipv6_acl (per-user)
permit udp any any eq domain sequence 10
permit tcp any any eq domain sequence 20
permit icmp any any nd-ns sequence 30
permit icmp any any nd-na sequence 40
permit icmp any any router-solicitation sequence 50
permit icmp any any router-advertisement sequence 60
permit icmp any any redirect sequence 70
permit udp any eq 547 any eq 546 sequence 80
permit udp any eq 546 any eq 547 sequence 90
deny ipv6 any any sequence 100

How to Configure IPv6 ACLs

To filter IPv6 traffic, you perform these steps:
1 Create an IPv6 ACL, and enter IPv6 access list configuration mode.
2 Configure the IPv6 ACL to block (deny) or pass (permit) traffic.
3 Apply the IPv6 ACL to an interface. For router ACLs, you must also configure an IPv6 address on the
Layer 3 interface to which the ACL is applied.
OL-29434-01
or not they are supported on the platform. When you apply the ACL to an interface that requires hardware
forwarding (physical ports or SVIs), the switch checks to determine whether or not the ACL can be
supported on the interface. If not, attaching the ACL is rejected.
unsupported keyword, the switch does not allow the ACE to be added to the ACL that is currently
attached to the interface.
Catalyst 2960-XR Switch Security Configuration Guide, Cisco IOS Release 15.0(2)EX1
Default Configuration for IPv6 ACLs
157