Cisco Systems 3750E manual Applying an IPv6 ACL to an Interface, Ipv6 address ipv6-address, 35-8

Chapter 35 Configuring IPv6 ACLs

Configuring IPv6 ACLs

Use the no {deny permit} IPv6 access-list configuration commands with keywords to remove the deny or permit conditions from the specified access list.

This example configures the IPv6 access list named CISCO. The first deny entry in the list denies all packets that have a destination TCP port number greater than 5000. The second deny entry denies packets that have a source UDP port number less than 5000. The second deny also logs all matches to the console. The first permit entry in the list permits all ICMP packets. The second permit entry in the list permits all other traffic. The second permit entry is necessary because an implicit deny -all condition is at the end of each IPv6 access list.

Switch(config)# ipv6 access-list CISCO

Switch(config-ipv6-acl)#	deny	tcp any		any gt 5000
Switch config-ipv6-acl)#	deny	::/0 lt		5000 ::/0 log
Switch(config-ipv6-acl)#	permit		icmp any any
Switch(config-ipv6-acl)#	permit		any any

Applying an IPv6 ACL to an Interface

This section describes how to apply IPv6 ACLs to network interfaces. If the switch is running the advanced IP services feature set, you can apply an ACL to outbound or inbound traffic on Layer 3 interfaces, or to inbound traffic on Layer 2 interfaces. If the switch is running the IP services or IP base feature set, you can apply ACLs only to inbound management traffic on Layer 3 interfaces.

Beginning in privileged EXEC mode, follow these steps to control access to an interface:

	Command	Purpose
Step 1
	configure terminal	Enter global configuration mode.
Step 2
	interface interface-id	Identify a Layer 2 interface (for port ACLs) or Layer 3 interface (for router
		ACLs) on which to apply an access list, and enter interface configuration mode.
		Note Switches running the IP services or IP base feature set do not support
		port ACLs.
Step 3
	no switchport	If applying a router ACL, change the interface from Layer 2 mode (the default)
		to Layer 3 mode.
Step 4
	ipv6 address ipv6-address	Configure an IPv6 address on a Layer 3 interface (for router ACLs).
		Note This command is not required on Layer 2 interfaces or if the interface
		has already been configured with an explicit IPv6 address.
Step 5
	ipv6 traffic-filter access-list-name	Apply the access list to incoming or outgoing traffic on the interface.
	{in out}	Note The out keyword is not supported for Layer 2 interfaces (port ACLs).
		If the switch is running the IP services or IP base feature set, the out
		keyword is not supported for Layer 3 interfaces.
Step 6
	end	Return to privileged EXEC mode.
Step 7
	show running-config	Verify the access list configuration.
Step 8
	copy running-config	(Optional) Save your entries in the configuration file.
	startup-config

Catalyst 3750-E and 3560-E Switch Software Configuration Guide

35-8 OL-9775-02