Contents

IPv6 ACL Extensions for Hop by Hop Filtering

The IPv6 ACL Extensions for Hop by Hop Filtering feature allows you to control IPv6 traffic that might contain hop-by-hop extension headers. You can configure an access control list (ACL) to deny all hop-by-hop traffic or to selectively permit traffic based on protocol.

Finding Feature Information

Your software release may not support all the features documented in this module. For the latest caveats and feature information, see Bug Search Tool and the release notes for your platform and software release. To find information about the features documented in this module, and to see a list of the releases in which each feature is supported, see the feature information table at the end of this module.

Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to www.cisco.com/​go/​cfn. An account on Cisco.com is not required.

Information About IPv6 ACL Extensions for Hop by Hop Filtering

ACLs and Traffic Forwarding

IPv6 access control lists (ACLs) determine what traffic is blocked and what traffic is forwarded at device interfaces. ACLs allow filtering based on source and destination addresses, inbound and outbound to a specific interface. Use the ipv6 access-list command to define an IPv6 ACL, and the deny and permit commands to configure its conditions.

The IPv6 ACL Extensions for Hop by Hop Filtering feature implements RFC 2460 to support traffic filtering in any upper-layer protocol type.

How to Configure IPv6 ACL Extensions for Hop by Hop Filtering

Configuring IPv6 ACL Extensions for Hop by Hop Filtering

SUMMARY STEPS

    1.    enable

    2.    configure terminal

    3.    ipv6 access-list access-list-name

    4.    permit protocol {source-ipv6-prefix/prefix-length | any | host source-ipv6-address | auth} [operator [port-number]] {destination-ipv6-prefix/prefix-length | any | host destination-ipv6-address | auth} [operator [port-number]] [dest-option-type [header-number | header-type]] [dscp value] [flow-label value] [fragments] [hbh] [log] [log-input] [mobility] [mobility-type [mh-number | mh-type]] [reflect name [timeout value]] [routing] [routing-type routing-number] [sequence value] [time-range name]

    5.    deny protocol {source-ipv6-prefix/prefix-length | any | host source-ipv6-address | auth} [operator [port-number]] {destination-ipv6-prefix/prefix-length | any | host destination-ipv6-address | auth} [operator [port-number]] [dest-option-type [header-number | header-type]] [dscp value] [flow-label value] [fragments] [hbh] [log] [log-input] [mobility] [mobility-type [mh-number | mh-type]] [routing] [routing-type routing-number] [sequence value] [time-range name] [undetermined-transport]

    6.    end


DETAILED STEPS
     Command or ActionPurpose
    Step 1 enable


    Example:
    Device> enable
     

    Enables privileged EXEC mode.

    • Enter your password if prompted.

     
    Step 2 configure terminal


    Example:
    Device# configure terminal
     

    Enters global configuration mode.

     
    Step 3 ipv6 access-list access-list-name


    Example:
    Device(config)# ipv6 access-list hbh-acl
     

    Defines an IPv6 ACL and enters IPv6 access list configuration mode.

     
    Step 4 permit protocol {source-ipv6-prefix/prefix-length | any | host source-ipv6-address | auth} [operator [port-number]] {destination-ipv6-prefix/prefix-length | any | host destination-ipv6-address | auth} [operator [port-number]] [dest-option-type [header-number | header-type]] [dscp value] [flow-label value] [fragments] [hbh] [log] [log-input] [mobility] [mobility-type [mh-number | mh-type]] [reflect name [timeout value]] [routing] [routing-type routing-number] [sequence value] [time-range name]

    Example:
    Device(config-ipv6-acl)# permit icmp any any dest-option-type
    
     

    Sets permit conditions for the IPv6 ACL.

     
    Step 5 deny protocol {source-ipv6-prefix/prefix-length | any | host source-ipv6-address | auth} [operator [port-number]] {destination-ipv6-prefix/prefix-length | any | host destination-ipv6-address | auth} [operator [port-number]] [dest-option-type [header-number | header-type]] [dscp value] [flow-label value] [fragments] [hbh] [log] [log-input] [mobility] [mobility-type [mh-number | mh-type]] [routing] [routing-type routing-number] [sequence value] [time-range name] [undetermined-transport]


    Example:
    Device(config-ipv6-acl)# deny icmp any any dest-option-type
    
     

    Sets deny conditions for the IPv6 ACL.

     
    Step 6end


    Example:
    Device (config-ipv6-acl)# end 
     

    Returns to privileged EXEC configuration mode.

     

    Configuration Example for IPv6 ACL Extensions for Hop by Hop Filtering

    Example: IPv6 ACL Extensions for Hop by Hop Filtering

    Device(config)# ipv6 access-list hbh_acl
    Device(config-ipv6-acl)# permit tcp any any hbh
    Device(config-ipv6-acl)# permit tcp any any
    Device(config-ipv6-acl)# permit udp any any
    Device(config-ipv6-acl)# permit udp any any hbh
    Device(config-ipv6-acl)# permit hbh any any
    Device(config-ipv6-acl)# permit any any
    Device(config-ipv6-acl)# hardware statistics
    Device(config-ipv6-acl)# exit
    
    ! Assign an IP address and add the ACL on the interface.
    
    Device(config)# interface FastEthernet3/1
    Device(config-if)# ipv6 address 1001::1/64
    Device(config-if)# ipv6 traffic-filter hbh_acl in
    Device(config-if)# exit
    Device(config)# exit
    Device# clear counters
    Clear "show interface" counters on all interfaces [confirm]
    Device# 
    
    ! Verify the configurations.
    
    Device# show running-config interface FastEthernet3/1
    
    Building configuration...
    
    Current configuration : 114 bytes
    !
    interface FastEthernet3/1
    no switchport
    ipv6 address 1001::1/64
    ipv6 traffic-filter hbh_acl
    end
          

    Additional References

    Related Documents

    Related Topic

    Document Title

    IPv6 addressing and connectivity

    IPv6 Configuration Guide

    Cisco IOS commands

    Cisco IOS Master Commands List, All Releases

    IPv6 commands

    Cisco IOS IPv6 Command Reference

    Cisco IOS IPv6 features

    Cisco IOS IPv6 Feature Mapping

    Standards and RFCs

    Standard/RFC

    Title

    RFCs for IPv6

    IPv6 RFCs

    MIBs

    MIB

    MIBs Link

    To locate and download MIBs for selected platforms, Cisco IOS releases, and feature sets, use Cisco MIB Locator found at the following URL:

    http:/​/​www.cisco.com/​go/​mibs

    Technical Assistance

    Description

    Link

    The Cisco Support and Documentation website provides online resources to download documentation, software, and tools. Use these resources to install and configure the software and to troubleshoot and resolve technical issues with Cisco products and technologies. Access to most tools on the Cisco Support and Documentation website requires a Cisco.com user ID and password.

    http:/​/​www.cisco.com/​cisco/​web/​support/​index.html

    Feature Information for IPv6 ACL Extensions for Hop by Hop Filtering

    The following table provides release information about the feature or features described in this module. This table lists only the software release that introduced support for a given feature in a given software release train. Unless noted otherwise, subsequent releases of that software release train also support that feature.

    Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to www.cisco.com/​go/​cfn. An account on Cisco.com is not required.

    Table 1 Feature Information for IPv6 ACL Extensions for Hop by Hop Filtering

    Feature Name

    Releases

    Feature Information

    IPv6 ACL Extensions for Hop by Hop Filtering

    Cisco IOS Release XE 3.4S

    Cisco IOS Release XE 3.5S

    Cisco IOS Release XE 3.6S

    Cisco IOS Release XE 3.3SG

    Allows you to control IPv6 traffic that might contain hop-by-hop extension headers.

    The following commands were introduced or modified: deny (IPv6), permit (IPv6).


    IPv6 ACL Extensions for Hop by Hop Filtering

    IPv6 ACL Extensions for Hop by Hop Filtering

    The IPv6 ACL Extensions for Hop by Hop Filtering feature allows you to control IPv6 traffic that might contain hop-by-hop extension headers. You can configure an access control list (ACL) to deny all hop-by-hop traffic or to selectively permit traffic based on protocol.

    Finding Feature Information

    Your software release may not support all the features documented in this module. For the latest caveats and feature information, see Bug Search Tool and the release notes for your platform and software release. To find information about the features documented in this module, and to see a list of the releases in which each feature is supported, see the feature information table at the end of this module.

    Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to www.cisco.com/​go/​cfn. An account on Cisco.com is not required.

    Information About IPv6 ACL Extensions for Hop by Hop Filtering

    ACLs and Traffic Forwarding

    IPv6 access control lists (ACLs) determine what traffic is blocked and what traffic is forwarded at device interfaces. ACLs allow filtering based on source and destination addresses, inbound and outbound to a specific interface. Use the ipv6 access-list command to define an IPv6 ACL, and the deny and permit commands to configure its conditions.

    The IPv6 ACL Extensions for Hop by Hop Filtering feature implements RFC 2460 to support traffic filtering in any upper-layer protocol type.

    How to Configure IPv6 ACL Extensions for Hop by Hop Filtering

    Configuring IPv6 ACL Extensions for Hop by Hop Filtering

    SUMMARY STEPS

      1.    enable

      2.    configure terminal

      3.    ipv6 access-list access-list-name

      4.    permit protocol {source-ipv6-prefix/prefix-length | any | host source-ipv6-address | auth} [operator [port-number]] {destination-ipv6-prefix/prefix-length | any | host destination-ipv6-address | auth} [operator [port-number]] [dest-option-type [header-number | header-type]] [dscp value] [flow-label value] [fragments] [hbh] [log] [log-input] [mobility] [mobility-type [mh-number | mh-type]] [reflect name [timeout value]] [routing] [routing-type routing-number] [sequence value] [time-range name]

      5.    deny protocol {source-ipv6-prefix/prefix-length | any | host source-ipv6-address | auth} [operator [port-number]] {destination-ipv6-prefix/prefix-length | any | host destination-ipv6-address | auth} [operator [port-number]] [dest-option-type [header-number | header-type]] [dscp value] [flow-label value] [fragments] [hbh] [log] [log-input] [mobility] [mobility-type [mh-number | mh-type]] [routing] [routing-type routing-number] [sequence value] [time-range name] [undetermined-transport]

      6.    end


    DETAILED STEPS
       Command or ActionPurpose
      Step 1 enable


      Example:
      Device> enable
       

      Enables privileged EXEC mode.

      • Enter your password if prompted.

       
      Step 2 configure terminal


      Example:
      Device# configure terminal
       

      Enters global configuration mode.

       
      Step 3 ipv6 access-list access-list-name


      Example:
      Device(config)# ipv6 access-list hbh-acl
       

      Defines an IPv6 ACL and enters IPv6 access list configuration mode.

       
      Step 4 permit protocol {source-ipv6-prefix/prefix-length | any | host source-ipv6-address | auth} [operator [port-number]] {destination-ipv6-prefix/prefix-length | any | host destination-ipv6-address | auth} [operator [port-number]] [dest-option-type [header-number | header-type]] [dscp value] [flow-label value] [fragments] [hbh] [log] [log-input] [mobility] [mobility-type [mh-number | mh-type]] [reflect name [timeout value]] [routing] [routing-type routing-number] [sequence value] [time-range name]

      Example:
      Device(config-ipv6-acl)# permit icmp any any dest-option-type
      
       

      Sets permit conditions for the IPv6 ACL.

       
      Step 5 deny protocol {source-ipv6-prefix/prefix-length | any | host source-ipv6-address | auth} [operator [port-number]] {destination-ipv6-prefix/prefix-length | any | host destination-ipv6-address | auth} [operator [port-number]] [dest-option-type [header-number | header-type]] [dscp value] [flow-label value] [fragments] [hbh] [log] [log-input] [mobility] [mobility-type [mh-number | mh-type]] [routing] [routing-type routing-number] [sequence value] [time-range name] [undetermined-transport]


      Example:
      Device(config-ipv6-acl)# deny icmp any any dest-option-type
      
       

      Sets deny conditions for the IPv6 ACL.

       
      Step 6end


      Example:
      Device (config-ipv6-acl)# end 
       

      Returns to privileged EXEC configuration mode.

       

      Configuration Example for IPv6 ACL Extensions for Hop by Hop Filtering

      Example: IPv6 ACL Extensions for Hop by Hop Filtering

      Device(config)# ipv6 access-list hbh_acl
      Device(config-ipv6-acl)# permit tcp any any hbh
      Device(config-ipv6-acl)# permit tcp any any
      Device(config-ipv6-acl)# permit udp any any
      Device(config-ipv6-acl)# permit udp any any hbh
      Device(config-ipv6-acl)# permit hbh any any
      Device(config-ipv6-acl)# permit any any
      Device(config-ipv6-acl)# hardware statistics
      Device(config-ipv6-acl)# exit
      
      ! Assign an IP address and add the ACL on the interface.
      
      Device(config)# interface FastEthernet3/1
      Device(config-if)# ipv6 address 1001::1/64
      Device(config-if)# ipv6 traffic-filter hbh_acl in
      Device(config-if)# exit
      Device(config)# exit
      Device# clear counters
      Clear "show interface" counters on all interfaces [confirm]
      Device# 
      
      ! Verify the configurations.
      
      Device# show running-config interface FastEthernet3/1
      
      Building configuration...
      
      Current configuration : 114 bytes
      !
      interface FastEthernet3/1
      no switchport
      ipv6 address 1001::1/64
      ipv6 traffic-filter hbh_acl
      end
            

      Additional References

      Related Documents

      Related Topic

      Document Title

      IPv6 addressing and connectivity

      IPv6 Configuration Guide

      Cisco IOS commands

      Cisco IOS Master Commands List, All Releases

      IPv6 commands

      Cisco IOS IPv6 Command Reference

      Cisco IOS IPv6 features

      Cisco IOS IPv6 Feature Mapping

      Standards and RFCs

      Standard/RFC

      Title

      RFCs for IPv6

      IPv6 RFCs

      MIBs

      MIB

      MIBs Link

      To locate and download MIBs for selected platforms, Cisco IOS releases, and feature sets, use Cisco MIB Locator found at the following URL:

      http:/​/​www.cisco.com/​go/​mibs

      Technical Assistance

      Description

      Link

      The Cisco Support and Documentation website provides online resources to download documentation, software, and tools. Use these resources to install and configure the software and to troubleshoot and resolve technical issues with Cisco products and technologies. Access to most tools on the Cisco Support and Documentation website requires a Cisco.com user ID and password.

      http:/​/​www.cisco.com/​cisco/​web/​support/​index.html

      Feature Information for IPv6 ACL Extensions for Hop by Hop Filtering

      The following table provides release information about the feature or features described in this module. This table lists only the software release that introduced support for a given feature in a given software release train. Unless noted otherwise, subsequent releases of that software release train also support that feature.

      Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to www.cisco.com/​go/​cfn. An account on Cisco.com is not required.

      Table 1 Feature Information for IPv6 ACL Extensions for Hop by Hop Filtering

      Feature Name

      Releases

      Feature Information

      IPv6 ACL Extensions for Hop by Hop Filtering

      Cisco IOS Release XE 3.4S

      Cisco IOS Release XE 3.5S

      Cisco IOS Release XE 3.6S

      Cisco IOS Release XE 3.3SG

      Allows you to control IPv6 traffic that might contain hop-by-hop extension headers.

      The following commands were introduced or modified: deny (IPv6), permit (IPv6).