How To Attach An Ipv6 Acl To An Interface - Cisco Catalyst 2960-XR Security Configuration Manual

Configuring IPv6 ACLs
Use the no {deny | permit} IPv6 access-list configuration commands with keywords to remove the deny or
permit conditions from the specified access list.
This example configures the IPv6 access list named CISCO. The first deny entry in the list denies all packets
that have a destination TCP port number greater than 5000. The second deny entry denies packets that have
a source UDP port number less than 5000. The second deny also logs all matches to the console. The first
permit entry in the list permits all ICMP packets. The second permit entry in the list permits all other traffic.
The second permit entry is necessary because an implicit deny -all condition is at the end of each IPv6 access
list.
Switch(config)# ipv6 access-list CISCO
Switch(config-ipv6-acl)# deny tcp any any gt 5000
Switch config-ipv6-acl)# deny ::/0 lt 5000 ::/0 log
Switch(config-ipv6-acl)# permit icmp any any
Switch(config-ipv6-acl)# permit any any
What to Do Next
Attach the IPv6 ACL to an Interface

How to Attach an IPv6 ACL to an Interface

You can apply an ACL to outbound or inbound traffic on Layer 3 interfaces, or to inbound traffic on Layer
2 interfaces. You can also apply ACLs only to inbound management traffic on Layer 3 interfaces.
Beginning in privileged EXEC mode, follow these steps to control access to an interface:
SUMMARY STEPS
1. configure terminal
2. interface interface-id
3. no switchport
4. ipv6 address pv6-address
5. ipv6 traffic-filter access-list-name {in | out}
6. end
7. show running-config
8. copy running-config startup-config
DETAILED STEPS
Command or Action
Step 1
configure terminal
Example:
Switch# configure terminal
OL-29434-01
Purpose
Enters the global configuration mode.
Catalyst 2960-XR Switch Security Configuration Guide, Cisco IOS Release 15.0(2)EX1
How to Attach an IPv6 ACL to an Interface
161