47-23
Software Configuration Guide—Release 15.0(2)SG
OL-23818-01
Chapter 47 Configuring Network Security with ACLs Configuring Named IPv6 ACLs
Switch(config)# mac access-list extended matching
Switch(config-ext-macl)# permit any any 0x8863
Switch(config-ext-macl)# permit any any 0x8040
Switch(config-ext-macl)# end
Switch # show access-lists matching
Extended MAC access list matching
permit any any 0x8863
permit any any netbios
Switch #
Configuring Named IPv6 ACLs
Note This section applies only to Supervisor Engine 6-E and Supervisor Engine 6L-E.
Supervisor Engine 6-E and 6L-E also support hardware-based IPv6 ACLs to filter unicast, multicast and
broadcast IPv6 traffic on Layer 2 and Layer 3 interfaces. You can only configure such access lists on
Layer 3 interfaces that are configured with an IPv6 address.
To create a named IPv6 ACLs, perform this task:
The following example shows how to create and display an IPv6 access list named v6test, denying only
one IPv6 traffic with one particular source and destination address, but permitting all other types of IPv6
traffic:
Switch(config)# ipv6 access-list v6test
Switch(config-ipv6-acl)# deny ipv6 host 2020::10 host 2040::10
Switch(config-ipv6-acl)# permit any any
Switch(config-ipv6-acl)# end
Switch# show ipv6 access-list
IPv6 access list v6test
deny ipv6 host 2020::10 host 2040::10 sequence 10
permit ipv6 any any sequence 20
To enable hardware statistics, enter the following commands while configuring ACEs in the access list:
Switch(config)# ipv6 access-list v6test
Switch(config-ipv6-acl)# hardware statistics
Switch(config-ipv6-acl)# end
Command Purpose
Step 1 Switch# configure terminal Enters global configuration mode.
Step 2 Switch(config)# ipv6 access-list name Defines an IPv6 access list using a name.
To delete the IPv6 ACL, use the no form of the command. You can
also delete individual ACEs from the IPv6 access list.
Step 3 Switch(config-ipv6-acl)# {deny | permit}
{any | proto} {host ipv6-addr |
ipv6-prefix} host ipv6-addr |
ipv6-prefix}
Specifies each IPv6 ACE.
Note Repeat this step to define multiple ACEs in the ACL.
Step 4 Switch(config-ipv6-acl)#
hardware statistics (Optional) Enables hardware statistics for the IPv6 ACL.
Step 5 Switch(config-ipv6-acl)# end Returns to privileged EXEC mode.
Step 6 Switch# show ipv6 access-list Display the IPv6 access list configuration.