Brocade Communications Systems 6650 manual Creating an IPv6 ACL, Syntax for creating an IPv6 ACL

Creating an IPv6 ACL

The first permit statement permits ICMP traffic from hosts in the 2001:db8:e0bb::x network to hosts in the 2001:db8::x network.

The deny statement denies ICMP neighbor discovery acknowledgement.

The last entry permits all packets that are not explicitly denied by the other entries. Without this entry, the ACL will deny all incoming IPv6 traffic on the ports to which you assigned the ACL.

Furthermore, if you add the statement deny icmp any any in the access list, then all neighbor discovery messages will be denied. You must explicitly enter the permit icmp any any nd-naand permit icmp any any nd-nsstatements just before the deny icmp statement if you want the ACLs to permit neighbor discovery as in the example below.

Brocade(config)# ipv6 access-list netw Brocade(config-ipv6-access-list-netw)# permit icmp 2001:db8:e0bb::/64 2001:3782::/64

Brocade(config-ipv6-access-list-netw)# permit icmp any any nd-na Brocade(config-ipv6-access-list-netw)# permit icmp any any nd-ns Brocade(config-ipv6-access-list-netw)# deny icmp any any Brocade(config-ipv6-access-list-netw)# permit ipv6 any any

Creating an IPv6 ACL

Before an IPv6 ACL can be applied to an interface, it must first be created, and then IPv6 must be enabled on that interface.

To create an IPv6 ACL, enter commands such as the following:

Brocade(config)# ipv6 access-list fdry	deny	tcp host 2001:db8:e0bb::2 any eq
Brocade(config-ipv6-access-list-fdry)#
telnet	permit ipv6 any any
Brocade(config-ipv6-access-list-fdry)#
Brocade(config-ipv6-access-list-fdry)#	exit

This creates an access list that blocks all Telnet traffic from IPv6 host 2001:db8:e0bb::2.

Syntax for creating an IPv6 ACL

•ipv6-operator dscp

•ipv6-operator fragments when any protocol is specified. The option "fragments" can be specified only when "permit/deny ipv6" is specified. If you specify "tcp" or any other protocol instead of "ipv6" the keyword, "fragments" cannot be used.

•ipv6-operator routing when any protocol is specified. (Same limitation as for ipv6-operator fragments)

When creating ACLs, use the appropriate syntax below for the protocol you are filtering.

For IPv6 and supported protocols other than ICMP, TCP, or UDP

Syntax: [no] ipv6 access-list ACL-name

132	Brocade ICX 6650 Security Configuration Guide
	53-1002601-01