permit, deny (Extended IPv6 ACL)
This command adds a rule to an Extended IPv6 ACL. The r ule sets a filter c ondit ion
for packets with specific destination IP addresses, next header type, or flo w label.
Use the no form to remove a rule .
Syntax
[no] {permit | deny}
{
any
|
destination-ipv6-address[/prefix-length]}
[
next-header
next-header] [
dscp
dscp] [
flow-label
flow-label]
•
any
– Keyword indicating any IPv6 destination address (an abbreviation for
the IPv6 prefix ::/0).
• destination-ipv6-address - An IP v6 des tination address. The address m ust
be formatted according to RFC 2373 “IPv6 Addressing Architecture,” using
8 colon-separated 16-bit hexadecimal values. One double colon may be
used in the address to indicate the appropriate number of zeros required to
fill the undefined fields. (The s witc h onl y c hec ks the fir st 64 bi ts of t he
destination address.)
• prefix-length - A decimal value indicating how many contiguous bits (from
the left) of the address comprise the p refix (i.e ., the ne two rk por tio n of th e
address).
• dscp – DSCP priority level. (Range: 0-63)
• flow-label – A label for packets belonging to a particular traffic “flow” for
which the sender requests special handling by IP v6 route rs, such as
non-default quality of service or “real-time” service (see RFC 2460).
(Range: 0-16777215)
• next-header – Identifies the type of header immediately following the IPv6
header. (Range: 0-255)
Default Setting
None
Command Mode
Extended IPv6 ACL
Command Usage
• All new rules are appended to the end of the list.
• A flow label is assigned to a flow by the flow's source node. New flow labels
must be chosen pseudo-randomly and uniformly from the range 1 to FFFFF
hexadecimal. The purpose of the random allocation is to make any set of bits
within the Flow Label field suitable for use as a hash key by routers, for looking
up the state associated with the flow.
A flow identifies a sequence of packets sent from a particul ar source to a
particular (unicast or multicast) destination for which the sou rce desires
special handling by the intervening routers. The nature of that special handling
might be conveyed to the routers by a con trol protoc ol, such as a resource
reservation protocol, or by information within the flow's packets themselves,
26-9
IPv6 ACLs
26