Filtering Access Control Lists ACL
You can configure the filters or ACLs using Layer 3 and Layer 4 information. You can configure an IPv6 ACL in a Cisco IOS router using the ipv6 access-list command. The command uses the permit and deny subcommands with the following options:
ipv6 access-list command and its subcommands permit protocol {source-ipv6-prefix/prefix-length I any I host source-ipv6-address} [operator [port-number]] {destination-ipv6-prefix/prefix-length I any I host destination-ipv6-address} [operator [port-number]] [dest-option-type [doh-number I doh-type]] [dscp value] [flow-label value] [fragments] [log] [log-input] [mobility] [mobility-type [mh-number I mh-type]] [reflect name [timeout value]] [routing] [routing-type routing-number] [sequence value] [time-range name] deny protocol {source-ipv6-prefix/prefix-length I any I host source-ipv6-address} [operator [port-number]] {destination-ipv6-prefix/prefix-length I any I host destination-ipv6-address} [operator [port-number]] [dest-option-type [doh-number I doh-type]] [dscp value] [flow-label value] [fragments] [log] [log-input] [mobility] [mobility-type [mh-number I mh-type]] [routing] [routing-type routing-number] [sequence value] [time-range name] [undetermined-transport]
Example 11-1 shows an ACL in a Cisco IOS router allowing HTTP traffic (TCP port 80) from a trusted IPv6 host and denying all other traffic.
Example 11-1 IPv6 Access Control List ipv6 access-list outside_acl permit tcp 2001:1234:0300:0101::/32 any eq 80 interface FastEthernet 0/0 ipv6 traffic-filter outside_acl in
In the previous example, the ACL name is outside_acl, and it is applied inbound to the FastEthernet 0/0 interface.
NOTE Standard IPv6 ACLs are supported starting with Cisco IOS Version 12.2(2)T and 12.0(21)ST and later.
In the Cisco ASA and Cisco PIX security appliances, the IPv6 ACLs are similar to IOS. To create an IPv6 ACL to allow the same host to pass HTTP traffic on the Cisco ASA or Cisco PIX, use the ipv6 access-list command, as shown in the following example:
ipv6 access-list asa_outside_acl permit tcp 2001:1234:0300:0101::/32 any eq www -access-group asa_outside_acl in interface outside
Notice that the IPv6 access list is applied to the outside interface using the access-group command just as for IPv4 access lists.
NOTE IPv6 has been supported on the Cisco PIX since Version 7.0. The Cisco ASA supports IPv6 in all versions, because the first version of Cisco ASA software is 7.0.
Continue reading here: Header Manipulation and Fragmentation
Was this article helpful?