Brocade Communications Systems 6650 manual Configuring an IPv6 ACL, Here is another example

Configuring an IPv6 ACL

Brocade(config)# ipv6 access-list netw Brocade(config-ipv6-access-list-netw)# permit icmp 2001:db8:e0bb::/64 2001:db8::/64

Brocade(config-ipv6-access-list-netw)# deny ipv6 host 2001:db8:e0ac::2 host 2000:2383:e0aa:0::24

Brocade(config-ipv6-access-list-netw)# deny udp any any Brocade(config-ipv6-access-list-netw)# permit ipv6 any any

The first condition permits ICMP traffic from hosts in the 2001:db8:e0bb::x network to hosts in the 2001:db8::x network.

The second condition denies all IPv6 traffic from host 2001:db8:e0ac::2 to host 2001:db8:e0aa:0::24.

The third condition denies all UDP traffic.

The fourth condition permits all packets that are not explicitly denied by the other entries. Without this entry, the ACL would deny all incoming IPv6 traffic on the ports to which you assigned the ACL.

The following commands apply the ACL "netw" to the incoming traffic on port 1/1/2 and to the incoming traffic on port 1/3/1.

Brocade(config)# interface ethernet 1/1/2

Brocade(config-if-e10000-1/1/2)# ipv6 enable

Brocade(config-if-e10000-1/1/2)# ipv6 traffic-filter netw in

Brocade(config-if-e10000-1/1/2)# exit

Brocade(config)# interface ethernet 1/3/1

Brocade(config-if-e10000-1/3/1)# ipv6 enable

Brocade(config-if-e10000-1/3/1)# ipv6 traffic-filter netw in

Brocade(config)# write memory

Here is another example.

Brocade(config)# ipv6 access-list nextone Brocade(config-ipv6-access-list rtr)# deny tcp 2001:db8:21::/24 2001:db8:22::/24

Brocade(config-ipv6-access-list rtr)# deny udp any range 5 6 2001:db8:22::/24 Brocade(config-ipv6-access-list rtr)# permit ipv6 any any Brocade(config-ipv6-access-list rtr)# write memory

The first condition in this ACL denies TCP traffic from the 2001:db8:21::x network to the 2001:db8:22::x network.

The next condition denies UDP packets from any source with source UDP port in ranges 5 to 6 and whose destination is to the 2001:db8:22::/24 network.

The third condition permits all packets containing source and destination addresses that are not explicitly denied by the first two. Without this entry, the ACL would deny all incoming IPv6 traffic on the ports to which you assign the ACL.

A show running-configcommand displays the following.

Brocade(config)# show running-config ipv6 access-list rtr

deny tcp 2001:db8:21::/24 2001:db8:22::/24 deny udp any range rje 6 2001:db8:22::/24 permit ipv6 any any

A show ipv6 access-listcommand displays the following.

130	Brocade ICX 6650 Security Configuration Guide
	53-1002601-01