Understanding Ipv6 Acls - Cisco Catalyst 2960 series Configuration Manual

Information About Configuring IPv6 ACLs

Understanding IPv6 ACLs

A switch image supports two types of IPv6 ACLs:
• IPv6 router ACLs - Supported on outbound or inbound traffic on Layer 3 interfaces, which can be routed
ports, switch virtual interfaces (SVIs), or Layer 3 EtherChannels. Applied to only IPv6 packets that are
routed.
• IPv6 port ACLs - Supported on inbound traffic on Layer 2 interfaces only. Applied to all IPv6 packets
entering the interface.
If you configure unsupported IPv6 ACLs, an error message appears and the configuration does not take
Note
affect.
The switch does not support VLAN ACLs (VLAN maps) for IPv6 traffic.
You can apply both IPv4 and IPv6 ACLs to an interface.
As with IPv4 ACLs, IPv6 port ACLs take precedence over router ACLs:
• When an input router ACL and input port ACL exist in an SVI, packets received on ports to which a
port ACL is applied are filtered by the port ACL. Routed IP packets received on other ports are filtered
by the router ACL. Other packets are not filtered.
• When an output router ACL and input port ACL exist in an SVI, packets received on the ports to which
a port ACL is applied are filtered by the port ACL. Outgoing routed IPv6 packets are filtered by the
router ACL. Other packets are not filtered.
If any port ACL (IPv4, IPv6, or MAC) is applied to an interface, that port ACL is used to filter packets,
Note
and any router ACLs attached to the SVI of the port VLAN are ignored.
Interactions with Other Features and Switches
• If an IPv6 router ACL is configured to deny a packet, the packet is not routed. A copy of the packet is
sent to the Internet Control Message Protocol (ICMP) queue to generate an ICMP unreachable message
for the frame.
• If a bridged frame is to be dropped due to a port ACL, the frame is not bridged.
• You can create both IPv4 and IPv6 ACLs on a switch or switch stack, and you can apply both IPv4 and
IPv6 ACLs to the same interface. Each ACL must have a unique name; an error message appears if you
try to use a name that is already configured.
You use different commands to create IPv4 and IPv6 ACLs and to attach IPv4 or IPv6 ACLs to the same
Layer 2 or Layer 3 interface. If you use the wrong command to attach an ACL (for example, an IPv4
command to attach an IPv6 ACL), you receive an error message.
• You cannot use MAC ACLs to filter IPv6 frames. MAC ACLs can only filter non-IP frames.
Consolidated Platform Configuration Guide, Cisco IOS Release 15.2(4)E (Catalyst 2960-X Switches)
1220