11.7. ACLv6 Commands

Command Purpose

Use this command to create IPv6 ACL and then enter IPv6 ACL in global configuration mode.

Prerequisites

Command Syntax

ipv6 access-list ACL_NAME

no ipv6 access-list ACL_NAME

Command Mode

Global Config

Default

None

Usage

If the system already has an IPv6 ACL with the same name, this command will enter the IPv6 ACL configuration mode. However, if the ACL name is used by other type of ACL, a prompt message will be shown.

When the name is not used by any ACL, this command is to create the IPv6 ACL firstly and then enter the IPv6 ACL configuration mode.

Examples

This example shows how to create an IPv6 ACL named list_ipv6_1 and then enter the IPv6 ACL configuration mode:

Switch# configure terminal
Switch(config)# ipv6 access-list list_ipv6_1
Switch(config-ipv6-acl)#

This example shows how to remove the IPv6 ACL named list_ipv6_1:

Switch# configure terminal
Switch(config)# no ipv6 access-list list_ipv6_1

Related Commands

match access-group

Command Purpose

Use this command to remove a filter from IPv6 ACL.

Prerequisites

Command Syntax

no sequence-num SEQUENCE_NUM

Command Mode

IPv6 ACL Configuration

Default

None

Usage

None

Examples

This example shows how to remove a filter with the sequence-num 10 from IPv6 ACL:

Switch# configure terminal
Switch(config)# ipv6 access-list list_ipv6_1
Switch(config-ipv6-acl)# no sequence-num 10

Related Commands

deny

deny tcp

deny udp

deny icmp

permit

permit tcp

permit udp

permit icmp

Command Purpose

Use this command to add remarks for the IPv6 ACL.

To remove remarks of the IPv6 ACL, use the no form of this command.

Prerequisites

Command Syntax

remark REMARK

no remark

Command Mode

IPv6 ACL Configuration

Default

None

Usage

The remarks are up to 100 characters. The exceed parts will not be stored and will be truncated.

Examples

This example shows how to add a remark to describe the IPv6 ACL:

Switch# configure terminal
Switch(config)# ipv6 access-list list_ipv6_1
Switch(config-ipv6-acl)# remark remark of List for ipv6

This example shows how to remove the remark of the IPv6 ACL:

Switch# configure terminal
Switch(config)# ipv6 access-list list_ipv6_1
Switch(config-ipv6-acl)# no remark

Related Commands

ipv6 access-list

Command Purpose

Use this command to discard ongoing IPv6 packets matching the IPv6 filter.

Prerequisites

Command Syntax

( SEQUENCE_NUM | ) deny ( PROTO_NUM | any ) ( SRC_IPV6 SRC_IPV6_MASK | any | host SRC_IPV6 ) ( DST_IPV6 DST_IPV6_MASK | any | host DST_IPV6 ) ( flow-label FLOW_LABEL | ) ( non-fragment | first-fragment | non-or-first-fragment | small-fragment | non-first-fragment | ) ( dscp DSCP | ) ( routed-packet | ) (packet-length OPERATOR LENGTH | ) ( time-range TIME-RANGE-NAME | )

Command Mode

IPv6 ACL Configuration

Default

None

Usage

An auto-generated sequence number will be assigned to the filter if the sequence-num field is not presented. The auto-generated sequence number is incremented by 10 on the maximum existing sequence number in the IPv6 ACL. For example, when the maximum existing sequence number is 100, the sequence number of subsequent created IPv6 filter is 110.

Examples

This example shows how to create a filter in IPv6 ACL to deny any IPv6 packets:

Switch# configure terminal
Switch(config)# ipv6 access-list list_ipv6_1
Switch(config-ipv6-acl)# 1 deny any any any

This example shows how to create a filter in IPv6 ACL to deny any routed packets:

Switch# configure terminal
Switch(config)# ipv6 access-list list_ipv6_1
Switch(config-ipv6-acl)# 2 deny any any any routed-packet

Related Commands

no sequence-num

Command Purpose

Use this command to reject TCP packets matching the IPv6 filter.

Prerequisites

Command Syntax

( SEQUENCE_NUM | ) deny tcp ( SRC_IPV6 SRC_IPV6_MASK | any | host SRC_IPV6 ) ( src-port OPERATOR SRC_PORT | ) ( DST_IPV6 DST_IPV6_MASK | any | host DST_IPV6 ) ( dst-port OPERATOR DST_PORT | ) ( flow-label FLOW_LABEL | ) ( non-fragment | first-fragment | non-or-first-fragment | small-fragment | non-first-fragment | ) ( dscp DSCP | ) ( routed-packet | ) ( packet-length OPERATOR LENGTH | ) ( time-range TIME-RANGE-NAME | )

Command Mode

IPv6 ACL Configuration

Default

None

Usage

None

Examples

This example shows how to create a filter in IPv6 ACL to deny any TCP packets:

Switch# configure terminal
Switch(config)# ipv6 access-list list_ipv6_1
Switch(config-ipv6-acl)# 1 deny tcp any any

This example shows how to create a filter in IPv6 ACL to deny the TCP packets with the source IPv6 address 2001::2020, source port 8080:

Switch# configure terminal
Switch(config)# ipv6 access-list list_ipv6_1
Switch(config-ipv6-acl)# 2 deny tcp host 2001::2020 src-port eq 8080 any

Related Commands

no sequence-num

Command Purpose

Use this command to reject UDP packets matching the IPv6 filter.

Prerequisites

Command Syntax

( SEQUENCE_NUM | ) deny udp ( SRC_IPV6 SRC_IPV6_MASK | any | host SRC_IPV6 ) ( src-port OPERATOR SRC_PORT | ) ( DST_IPV6 DST_IPV6_MASK | any | host DST_IPV6 ) ( dst-port OPERATOR DST_PORT | ) ( flow-label FLOW_LABEL | ) ( non-fragment | first-fragment | non-or-first-fragment | small-fragment | non-first-fragment | ) ( dscp DSCP | ) ( routed-packet | ) ( packet-length OPERATOR LENGTH | ) ( time-range TIME-RANGE-NAME | )

Command Mode

IPv6 ACL Configuration

Default

None

Usage

None

Examples

This example shows how to create a filter in IPv6 ACL to deny any UDP packets:

Switch# configure terminal
Switch(config)# ipv6 access-list list_ipv6_1
Switch(config-ipv6-acl)# 1 deny udp any any

This example shows how to create a filter in IPv6 ACL to deny the UDP packets with the source IPv6 address 2001::2020, source port 8080:

Switch# configure terminal
Switch(config)# ipv6 access-list list_ipv6_1
Switch(config-ipv6-acl)# 2 deny udp host 2001::2020 src-port eq 8080 any

Related Commands

no sequence-num

Command Purpose

Use this command to reject ICMP packets matching the IPv6 filter.

Prerequisites

Command Syntax

( SEQUENCE_NUM | ) deny icmp ( SRC_IPV6 SRC_IPV6_MASK | any | host SRC_IPV6 ) ( DST_IPV6 DST_IPV6_MASK | any | host DST_IPV6 ) ( icmp-type TYPE-NUM ( icmp-code CODE-NUM | ) | ) ( flow-label FLOW_LABEL | ) ( non-fragment | first-fragment | non-or-first-fragment | small-fragment | non-first-fragment | ) ( dscp DSCP | ) ( routed-packet | ) ( packet-length OPERATOR LENGTH | ) ( time-range TIME-RANGE-NAME | )

Command Mode

IPv6 ACL Configuration

Default

None

Usage

None

Examples

This example shows how to create a filter in IPv6 ACL to deny any ICMP packets:

Switch# configure terminal
Switch(config)# ipv6 access-list list_ipv6_1
Switch(config-ipv6-acl)# 1 deny icmp any any

This example shows how to create a filter in IPv6 ACL to deny the ICMP packets with the icmp-type 3 and icmp-code 3:

Switch# configure terminal
Switch(config)# ipv6 access-list list_ipv6_1
Switch(config-ipv6-acl)# 2 deny icmp any any icmp-type 3 icmp-code 3

Related Commands

no sequence-num

Command Purpose

Use this command to reject GRE packets matching the IPv6 filter.

Prerequisites

Command Syntax

( SEQUENCE_NUM | ) deny gre ( SRC_IPV6 SRC_IPV6_MASK | any | host SRC_IPV6 ) ( DST_IPV6 DST_IPV6_MASK | any | host DST_IPV6 ) ( flow-label FLOW-LABEL-VALUE | ) ( key KEY mask KEY-MASK ) ( dscp DSCP | ) ( ecn <0-3> | ) ( non-fragment | first-fragment | non-or-first-fragment | small-fragment | non-first-fragment | ) ( routed-packet | ) ( options | ) ( packet-length OPERATOR LENGTH | ) ( time-range TIME-RANGE-NAME | )

Command Mode

IPv6 ACL Configuration

Default

None

Usage

None

Examples

Switch# configure terminal
Switch(config)# ipv6 access-list list_ipv6_1
Switch(config-ipv6-acl)# 1 deny gre any any key 0 mask 0

Switch# configure terminal
Switch(config)# ipv6 access-list list_ipv6_1
Switch(config-ipv6-acl)# 2 deny gre host 2000::1 any key 10 mask 0xffffffff

Related Commands

no sequence-num

Command Purpose

Use this command to reject NVGRE packets matching the IPv6 filter.

Prerequisites

Command Syntax

( SEQUENCE_NUM | ) deny nvgre ( SRC_IPV6 SRC_IPV6_MASK | any | host SRC_IPV6 ) ( DST_IPV6 DST_IPV6_MASK | any | host DST_IPV6 ) ( flow-label FLOW-LABEL-VALUE | ) ( vsid VSID mask VSID-MASK ) ( dscp DSCP | ) ( ecn <0-3> | ) ( non-fragment | first-fragment | non-or-first-fragment | small-fragment | non-first-fragment | ) ( routed-packet | ) ( options | ) ( packet-length OPERATOR LENGTH | ) ( time-range TIME-RANGE-NAME | )

Command Mode

IPv6 ACL Configuration

Default

None

Usage

None

Examples

Switch# configure terminal
Switch(config)# ipv6 access-list list_ipv6_1
Switch(config-ipv6-acl)# 1 deny nvgre any any vsid 0 mask 0

Switch# configure terminal
Switch(config)# ipv6 access-list list_ipv6_1
Switch(config-ipv6-acl)# 2 deny gre host 2000::1 any vsid 10 mask 0xffffff

Related Commands

no sequence-num

Command Purpose

Use this command to permit ongoing IPv6 packets matching the IPv6 filter.

Prerequisites

Command Syntax

( SEQUENCE_NUM | ) permit ( PROTO_NUM | any ) ( SRC_IPV6 SRC_IPV6_MASK | any | host SRC_IPV6 ) ( DST_IPV6 DST_IPV6_MASK | any | host DST_IPV6 ) ( flow-label FLOW_LABEL | ) ( non-fragment | first-fragment | non-or-first-fragment | small-fragment | non-first-fragment | ) ( dscp DSCP | ) ( routed-packet | ) ( packet-length OPERATOR LENGTH | ) ( time-range TIME-RANGE-NAME | )

Command Mode

IPv6 ACL Configuration

Default

None

Usage

An auto-generated sequence number will be assigned to the filter if the sequence-num field is not presented. The auto-generated sequence number is incremented by 10 on the maximum existing sequence number in the IPv6 ACL. For example, when the maximum existing sequence number is 100, the sequence number of subsequent created IPv6 filter is 110.

Examples

This example shows how to create a filter in IPv6 ACL to permit any IPv6 packets:

Switch# configure terminal
Switch(config)# ipv6 access-list list_ipv6_1
Switch(config-ipv6-acl)# 1 permit any any any

This example shows how to create a filter in IPv6 ACL to permit any routed packets:

Switch# configure terminal
Switch(config)# ipv6 access-list list_ipv6_1
Switch(config-ipv6-acl)# 2 permit any any any routed-packet

Related Commands

no sequence-num

Command Purpose

Use this command to permitTCP packets matching the IPv6 filter.

Prerequisites

Command Syntax

( SEQUENCE_NUM | ) permit tcp ( SRC_IPV6 SRC_IPV6_MASK | any | host SRC_IPV6 ) ( src-port OPERATOR SRC_PORT | ) ( DST_IPV6 DST_IPV6_MASK | any | host DST_IPV6 ) ( dst-port OPERATOR DST_PORT | ) ( flow-label FLOW_LABEL | ) ( non-fragment | first-fragment | non-or-first-fragment | small-fragment | non-first-fragment | ) ( dscp DSCP | ) ( routed-packet | ) ( packet-length OPERATOR LENGTH | ) ( time-range TIME-RANGE-NAME | )

Command Mode

IPv6 ACL Configuration

Default

None

Usage

None

Examples

This example shows how to create a filter in IPv6 ACL to permit any TCP packets:

Switch# configure terminal
Switch(config)# ipv6 access-list list_ipv6_1
Switch(config-ipv6-acl)# 1 permit tcp any any

This example shows how to create a filter in IPv6 ACL to permit the TCP packets with the source IPv6 address 2001::2020, source port 8080:

Switch# configure terminal
Switch(config)# ipv6 access-list list_ipv6_1
Switch(config-ipv6-acl)# 2 permit tcp host 2001::2020 src-port eq 8080 any

Related Commands

no sequence-num

Command Purpose

Use this command to permit UDP packets matching the IPv6 filter.

Prerequisites

Command Syntax

( SEQUENCE_NUM | ) permit udp ( SRC_IPV6 SRC_IPV6_MASK | any | host SRC_IPV6 ) ( src-port OPERATOR SRC_PORT | ) ( DST_IPV6 DST_IPV6_MASK | any | host DST_IPV6 ) ( dst-port OPERATOR DST_PORT | ) ( flow-label FLOW_LABEL | ) ( non-fragment | first-fragment | non-or-first-fragment | small-fragment | non-first-fragment | ) ( dscp DSCP | ) ( routed-packet | ) ( packet-length OPERATOR LENGTH | ) ( time-range TIME-RANGE-NAME | )

Command Mode

IPv6 ACL Configuration

Default

None

Usage

None

Examples

This example shows how to create a filter in IPv6 ACL to permit any UDP packets:

Switch# configure terminal
Switch(config)# ipv6 access-list list_ipv6_1
Switch(config-ipv6-acl)# 1 permit udp any any

This example shows how to create a filter in IPv6 ACL to permit the UDP packets with the source IPv6 address 2001::2020, source port 8080:

Switch# configure terminal
Switch(config)# ipv6 access-list list_ipv6_1
Switch(config-ipv6-acl)# 2 permit udp host 2001::2020 src-port eq 8080 any

Related Commands

no sequence-num

Command Purpose

Use this command to reject ICMP packets matching the IPv6 filter.

Prerequisites

Command Syntax

( SEQUENCE_NUM | ) permit icmp ( SRC_IPV6 SRC_IPV6_MASK | any | host SRC_IPV6 ) ( DST_IPV6 DST_IPV6_MASK | any | host DST_IPV6 ) ( icmp-type TYPE-NUM ( icmp-code CODE-NUM | ) | ) ( flow-label FLOW_LABEL | ) ( non-fragment | first-fragment | non-or-first-fragment | small-fragment | non-first-fragment | ) ( dscp DSCP | ) ( routed-packet | ) ( packet-length OPERATOR LENGTH | ) ( time-range TIME-RANGE-NAME | )

For descriptions of other parameters, please refer to the “permit” section above.

Command Mode

IPv6 ACL Configuration

Default

None

Usage

None

Examples

This example shows how to create a filter in IPv6 ACL to permit any ICMP packets:

Switch# configure terminal
Switch(config)# ipv6 access-list list_ipv6_1
Switch(config-ipv6-acl)# 1 permit icmp any any

This example shows how to create a filter in IPv6 ACL to permit the ICMP packets with the icmp-type 3 and icmp-code 3:

Switch# configure terminal
Switch(config)# ipv6 access-list list_ipv6_1
Switch(config-ipv6-acl)# 2 permit icmp any any icmp-type 3 icmp-code 3

Related Commands

no sequence-num

Command Purpose

Use this command to permit GRE packets matching the IPv6 filter.

Prerequisites

Command Syntax

( SEQUENCE_NUM | ) permit gre ( SRC_IPV6 SRC_IPV6_MASK | any | host SRC_IPV6 ) ( DST_IPV6 DST_IPV6_MASK | any | host DST_IPV6 ) ( flow-label FLOW-LABEL-VALUE | ) ( key KEY mask KEY-MASK ) ( dscp DSCP | ) ( ecn <0-3> | ) ( non-fragment | first-fragment | non-or-first-fragment | small-fragment | non-first-fragment | ) ( routed-packet | ) ( options | ) ( packet-length OPERATOR LENGTH | ) ( time-range TIME-RANGE-NAME | )

For descriptions of other parameters, please refer to the “deny gre” section above.