Table of Contents
Advertisement
Understanding IPv6 ACLs
A switch running the IP services or IP base feature set supports only input router IPv6 ACLs. It does not
support port ACLs or output IPv6 router ACLs.
If you configure unsupported IPv6 ACLs, an error message appears, and the configuration does not take
Note
affect.
If you create or apply an output router ACL or an input port ACL on a switch running the IP base or IP
services features set, the ACL is added to the switch configuration but does not take effect; an error
message appears. If you want to use the output router ACL or input port ACL, save the switch
configuration and enable the IP services feature set, which supports the ACL.
The switch does not support VLAN ACLs (VLAN maps) for IPv6 traffic.
For more information about ACL support on the switch, see
Note
with ACLs."
You can apply both IPv4 and IPv6 ACLs to an interface.
As with IPv4 ACLs, IPv6 port ACLs take precedence over router ACLs:
•
•
Note
If any port ACL (IPv4, IPv6, or MAC) is applied to an interface, that port ACL is used to filter packets,
and any router ACLs attached to the SVI of the port VLAN are ignored.
Supported ACL Features
IPv6 ACLs on the switch have these characteristics:
•
•
•
•
•
•
IPv6 ACL Limitations
With IPv4, you can configure standard and extended numbered IP ACLs, named IP ACLs, and MAC
ACLs. IPv6 supports only named ACLs.
The switch supports most Cisco IOS-supported IPv6 ACLs with these exceptions:
Cisco Catalyst Blade Switch 3130 and 3032 for Dell Software Configuration Guide
36-2
When an input router ACL and input port ACL are in an SVI, packets received on ports to which a
port ACL is applied are filtered by the port ACL. Routed IP packets received on other ports are
filtered by the router ACL. Other packets are not filtered.
When an output router ACL and input port ACL exist in an SVI, packets received on the ports to
which a port ACL is applied are filtered by the port ACL. Outgoing routed IPv6 packets are filtered
by the router ACL. Other packets are not filtered.
Fragmented frames (the fragments keyword as in IPv4) are supported.
The same statistics supported in IPv4 are supported for IPv6 ACLs.
If the switch runs out of hardware memory, packets associated with the ACL are forwarded to the
CPU, and the ACLs are applied in software.
Routed or bridged packets with hop-by-hop options have IPv6 ACLs applied in software.
Logging is supported for router ACLs, but not for port ACLs.
The switch supports IPv6 address-matching for a full range of prefix lengths.
Chapter 36
Configuring IPv6 ACLs
Chapter 35, "Configuring Network Security
OL-13270-06
Hide quick links:
Advertisement
Chapters
Table of Contents
Troubleshooting
