39-3
Catalyst 3560 Switch Software Configuration Guide
OL-8553-06
Chapter 39 Configuring IPv6 ACLs
Configuring IPv6 ACLs
• If the switch runs out of TCAM space, packets associated with the ACL label are forwarded to the
CPU, and the ACLs are applied in software.
• Routed or bridged packets with hop-by-hop options have IPv6 ACLs applied in software.
• Logging is supported for router ACLs, but not for port ACLs.

IPv6 ACL Limitations

With IPv4, you can configure standard and extended numbered IP ACLs, named IP ACLs, and MAC
ACLs. IPv6 supports only named ACLs.
The switch supports most Cisco IOS-supported IPv6 ACLs with some exceptions:
• IPv6 source and destination addresses—ACL matching is supported only on prefixes from /0 to /64
and host addresses (/128) that are in the extended universal identifier (EUI)-64 format. The switch
supports only these host addresses with no loss of information:
–
aggregatable global unicast addresses
–
link local addresses
• The switch does not support matching on these keywords: flowlabel, routing header, and
undetermined-transport.
• The switch does not support reflexive ACLs (the reflect keyword).
• This release supports only port ACLs and router ACLs for IPv6; it does not support VLAN ACLs
(VLAN maps).
• The switch does not apply MAC-based ACLs on IPv6 frames.
• You cannot apply IPv6 port ACLs to Layer 2 EtherChannels.
• The switch does not support output port ACLs.
• Output router ACLs and input port ACLs for IPv6 are supported only on switches. Switches support
only control plane (incoming) IPv6 ACLs.
• When configuring an ACL, there is no restriction on keywords entered in the ACL, regardless of
whether or not they are supported on the platform. When you apply the ACL to an interface that
requires hardware forwarding (physical ports or SVIs), the switch checks to determine whether or
not the ACL can be supported on the interface. If not, attaching the ACL is rejected.
• If an ACL is applied to an interface and you attempt to add an access control entry (ACE) with an
unsupported keyword, the switch does not allow the ACE to be added to the ACL that is currently
attached to the interface.
Configuring IPv6 ACLs
Before configuring IPv6 ACLs, you must select one of the dual IPv4 and IPv6 SDM templates.
To filter IPv6 traffic, you perform these steps:
Step 1 Create an IPv6 ACL, and enter IPv6 access list configuration mode.
Step 2 Configure the IPv6 ACL to block (deny) or pass (permit) traffic.