130 Brocade ICX 6650 Security Configuration Guide
53-1002601-01
Configuring an IPv6 ACL
The first condition permits ICMP traffic from hosts in the 2001:db8:e0bb::x network to hosts in the
2001:db8::x network.
The second condition denies all IPv6 traffic from host 2001:db8:e0ac::2 to host
2001:db8:e0aa:0::24.
The third condition denies all UDP traffic.
The fourth condition permits all packets that are not explicitly denied by the other entries. Without
this entry, the ACL would deny all incoming IPv6 traffic on the ports to which you assigned the ACL.
The following commands apply the ACL "netw" to the incoming traffic on port 1/1/2 and to the
incoming traffic on port 1/3/1.
Brocade(config)# interface ethernet 1/1/2
Brocade(config-if-e10000-1/1/2)# ipv6 enable
Brocade(config-if-e10000-1/1/2)# ipv6 traffic-filter netw in
Brocade(config-if-e10000-1/1/2)# exit
Brocade(config)# interface ethernet 1/3/1
Brocade(config-if-e10000-1/3/1)# ipv6 enable
Brocade(config-if-e10000-1/3/1)# ipv6 traffic-filter netw in
Brocade(config)# write memory
Here is another example.
Brocade(config)# ipv6 access-list nextone
Brocade(config-ipv6-access-list rtr)# deny tcp 2001:db8:21::/24
2001:db8:22::/24
Brocade(config-ipv6-access-list rtr)# deny udp any range 5 6 2001:db8:22::/24
Brocade(config-ipv6-access-list rtr)# permit ipv6 any any
Brocade(config-ipv6-access-list rtr)# write memory
The first condition in this ACL denies TCP traffic from the 2001:db8:21::x network to the
2001:db8:22::x network.
The next condition denies UDP packets from any source with source UDP port in ranges 5 to 6 and
whose destination is to the 2001:db8:22::/24 network.
The third condition permits all packets containing source and destination addresses that are not
explicitly denied by the first two. Without this entry, the ACL would deny all incoming IPv6 traffic on
the ports to which you assign the ACL.
A show running-config command displays the following.
A show ipv6 access-list command displays the following.
Brocade(config)# ipv6 access-list netw
Brocade(config-ipv6-access-list-netw)# permit icmp 2001:db8:e0bb::/64
2001:db8::/64
Brocade(config-ipv6-access-list-netw)# deny ipv6 host 2001:db8:e0ac::2 host
2000:2383:e0aa:0::24
Brocade(config-ipv6-access-list-netw)# deny udp any any
Brocade(config-ipv6-access-list-netw)# permit ipv6 any any
Brocade(config)# show running-config
ipv6 access-list rtr
deny tcp 2001:db8:21::/24 2001:db8:22::/24
deny udp any range rje 6 2001:db8:22::/24
permit ipv6 any any