IPv6 Management Security Features

Authorized IP Managers for IPv6

to 0 (“off”) and allow the corresponding bits in an authorized IPv6 address to be either “on” or “off”. As a result, only the four IPv6 addresses shown in Figure 6-5 are allowed access.

 

1st

2nd

3rd

4th

5th

6th

7th

8th

 

Block

Block

Block

Block

Block

Block

Block

Block

 

 

 

 

 

 

 

 

 

IPv6 Mask

FFFF

FFFF

FFFF

FFFF

FFFF

FFFF

FFFF

FFFC

IPv6 Address Entered with the “ipv6

2001

DB8

0000

0000

244

17FF

FEB6

D37D

authorized-managers” Command

 

 

 

 

 

 

 

 

Other Authorized IPv6 Addresses

2001

DB8

0000

0000

244

17FF

FEB6

D37C

 

2001

DB8

0000

0000

244

17FF

FEB6

D37E

 

2001

DB8

0000

0000

244

17FF

FEB6

D37F

 

 

 

 

 

 

 

 

 

Figure 6-5. Example: How Hexadecimal C in a Mask Authorizes Four IPv6 Manager Addresses

Example. Figure 6-6 shows an example in which a mask is applied to the IPv6 address: 2001:DB8:0000:0000:244:17FF:FEB6:D37D/64. The specified mask FFFF:FFFF:FFFF:FFF8:FFFF:FFFF:FFFF:FFFF configures eight management stations as authorized IP manager stations.

Note that, in this example, the IPv6 mask is applied as follows:

■Eight management stations in different subnets are authorized by the value of the fourth block (FFF8) in the 64-bit prefix ID (FFFF:FFFF:FFFF:FFF8) of the mask. (The fourth block of the prefix ID is often used to define subnets in an IPv6 network.)

The binary equivalent of FFF8 that is used to specify valid subnet IDs in the IPv6 addresses of authorized stations is: 1111 1111 1111 1000.

The three “off” bits (1000) in the last part of the this block (FFF8) of the mask allow for eight possible authorized IPv6 stations: 2001:DB8:0000:0000:244:17FF:FEB6:D37D 2001:DB8:0000:0001:244:17FF:FEB6:D37D 2001:DB8:0000:0002:244:17FF:FEB6:D37D 2001:DB8:0000:0003:244:17FF:FEB6:D37D 2001:DB8:0000:0004:244:17FF:FEB6:D37D 2001:DB8:0000:0005:244:17FF:FEB6:D37D 2001:DB8:0000:0006:244:17FF:FEB6:D37D 2001:DB8:0000:0007:244:17FF:FEB6:D37D

6-9