Information About Configuring IPv6 ACLs
You can filter IP version 6 (IPv6) traffic by creating IPv6 access control lists (ACLs) and applying them to interfaces similarly to the way that you create and apply IP version 4(IPv4) named ACLs. You can also create and apply input router ACLs to filter Layer 3 management traffic.
![]() Note |
To use IPv6, you must configure the dual IPv4 and IPv6 Switch Database Management (SDM) template on the switch. You select the template by entering the sdm prefer {default } global configuration command. |
Understanding IPv6 ACLs
A switch image supports two types of IPv6 ACLs:
- IPv6 router ACLs - Supported on outbound or inbound traffic on Layer 3 interfaces, which can be routed ports, switch virtual interfaces (SVIs), or Layer 3 EtherChannels. Applied to only IPv6 packets that are routed.
- IPv6 port ACLs - Supported on inbound traffic on Layer 2 interfaces only. Applied to all IPv6 packets entering the interface.
![]() Note |
If you configure unsupported IPv6 ACLs, an error message appears and the configuration does not take affect. |
The switch does not support VLAN ACLs (VLAN maps) for IPv6 traffic.
You can apply both IPv4 and IPv6 ACLs to an interface.
As with IPv4 ACLs, IPv6 port ACLs take precedence over router ACLs:
-
When an input router ACL and input port ACL exist in an SVI, packets received on ports to which a port ACL is applied are filtered by the port ACL. Routed IP packets received on other ports are filtered by the router ACL. Other packets are not filtered.
- When an output router ACL and input port ACL exist in an SVI, packets received on the ports to which a port ACL is applied are filtered by the port ACL. Outgoing routed IPv6 packets are filtered by the router ACL. Other packets are not filtered.
![]() Note |
If any port ACL (IPv4, IPv6, or MAC) is applied to an interface, that port ACL is used to filter packets, and any router ACLs attached to the SVI of the port VLAN are ignored. |
Supported ACL Features
IPv6 ACLs on the switch have these characteristics:
-
Fragmented frames (the fragments keyword as in IPv4) are supported.
-
The same statistics supported in IPv4 are supported for IPv6 ACLs.
-
If the switch runs out of TCAM space, packets associated with the ACL label are forwarded to the CPU, and the ACLs are applied in software.
-
Routed or bridged packets with hop-by-hop options have IPv6 ACLs applied in software.
-
Logging is supported for router ACLs, but not for port ACLs.
IPv6 ACL Limitations
With IPv4, you can configure standard and extended numbered IP ACLs, named IP ACLs, and MAC ACLs. IPv6 supports only named ACLs.
The switch supports most Cisco IOS-supported IPv6 ACLs with some exceptions:
-
IPv6 source and destination addresses-ACL matching is supported only on prefixes from /0 to /64 and host addresses (/128) that are in the extended universal identifier (EUI)-64 format. The switch supports only these host addresses with no loss of information:
-aggregatable global unicast addresses
-link local addresses
-
The switch does not support matching on these keywords: flowlabel, routing header, and undetermined-transport.
-
The switch does not support reflexive ACLs (the reflect keyword).
-
This release supports only port ACLs and router ACLs for IPv6; it does not support VLAN ACLs (VLAN maps).
-
The switch does not apply MAC-based ACLs on IPv6 frames.
-
You cannot apply IPv6 port ACLs to Layer 2 EtherChannels.
-
The switch does not support output port ACLs.
-
Output router ACLs and input port ACLs for IPv6 are supported only on . Switches support only control plane (incoming) IPv6 ACLs.
-
When configuring an ACL, there is no restriction on keywords entered in the ACL, regardless of whether or not they are supported on the platform. When you apply the ACL to an interface that requires hardware forwarding (physical ports or SVIs), the switch checks to determine whether or not the ACL can be supported on the interface. If not, attaching the ACL is rejected.
-
If an ACL is applied to an interface and you attempt to add an access control entry (ACE) with an unsupported keyword, the switch does not allow the ACE to be added to the ACL that is currently attached to the interface.