Cisco Catalyst 2960 Series, Configuration Manual

Page: 1300 / 2288

Prerequisites for IPV6 ACLs
The following are the prerequisites for IPV6 ACLs:
To use IPv6, you must configure the dual IPv4 and IPv6 Switch Database Management (SDM) template on
the switch. You select the template by entering the
sdm prefer {default | dual-ipv4-and-ipv6}
global
configuration command.
Restrictions for IPv6 ACLs
With IPv4, you can configure standard and extended numbered IP ACLs, named IP ACLs, and MAC ACLs.
IPv6 supports only named ACLs.
The switch supports most Cisco IOS-supported IPv6 ACLs with some exceptions:
• The switch does not support matching on these keywords: flowlabel , routing header , and
undetermined-transport .
• The switch does not support reflexive ACLs (the reflect keyword).
• This release supports only port ACLs and router ACLs for IPv6; it does not support VLAN ACLs (VLAN
maps).
• Output router ACLs and input port ACLs for IPv6 are supported only on switch stacks. Switches support
only control plane (incoming) IPv6 ACLs.
• The switch does not apply MAC-based ACLs on IPv6 frames.
• You cannot apply IPv6 port ACLs to Layer 2 EtherChannels.
• When configuring an ACL, there is no restriction on keywords entered in the ACL, regardless of whether
or not they are supported on the platform. When you apply the ACL to an interface that requires hardware
forwarding (physical ports or SVIs), the switch checks to determine whether or not the ACL can be
supported on the interface. If not, attaching the ACL is rejected.
• If an ACL is applied to an interface and you attempt to add an access control entry (ACE) with an
unsupported keyword, the switch does not allow the ACE to be added to the ACL that is currently
attached to the interface.
IPv6 ACLs on the switch have these characteristics:
• Fragmented frames (the fragments keyword as in IPv4) are supported
• The same statistics supported in IPv4 are supported for IPv6 ACLs.
• If the switch runs out of hardware space, the packets associated with the ACL are dropped on the interface.
• Routed or bridged packets with hop-by-hop options have IPv6 ACLs applied in software.
• Logging is supported for router ACLs, but not for port ACLs.
• The switch supports IPv6 address-matching for a full range of prefix-lengths.
Consolidated Platform Configuration Guide, Cisco IOS Release 15.2(4)E (Catalyst 2960-X Switches)
1218
Prerequisites for IPV6 ACLs