Cisco Catalyst 2960 Series, Configuration Manual

Page: 1313 / 2288

The second permit entry is necessary because an implicit deny -all condition is at the end of each IPv6 access
list.
Switch(config)# ipv6 access-list CISCO
Switch(config-ipv6-acl)# deny tcp any any gt 5000
Switch config-ipv6-acl)# deny ::/0 lt 5000 ::/0 log
Switch(config-ipv6-acl)# permit icmp any any
Switch(config-ipv6-acl)#
permit any any
Example: Applying IPv6 ACLs
This example shows how to apply the access list Cisco to outbound traffic on a Layer 3 interface.
Switch(config-if)# no switchport
Switch(config-if)# ipv6 address 2001::/64 eui-64
Switch(config-if)# ipv6 traffic-filter CISCO out
Example: Configuring PACL Mode and Applying IPv6 PACL on an Interface
Device# configure terminal
Device(config)# ipv6 access-list list1
Device(config-ipv6-acl)#
exit
Device(config-if)# ipv6 traffic-filter list1 in
Example: IPv6 ACL Extensions for Hop by Hop Filtering
Device(config)# ipv6 access-list hbh_acl
Device(config-ipv6-acl)#
permit tcp any any hbh
Device(config-ipv6-acl)# permit tcp any any
Device(config-ipv6-acl)# permit udp any any
Device(config-ipv6-acl)# permit udp any any hbh
Device(config-ipv6-acl)#
permit hbh any any
Device(config-ipv6-acl)# permit any any
Device(config-ipv6-acl)# hardware statistics
Device(config-ipv6-acl)# exit
! Assign an IP address and add the ACL on the interface.
Device(config)#
interface FastEthernet3/1
Device(config-if)# ipv6 address 1001::1/64
Device(config-if)# ipv6 traffic-filter hbh_acl in
Device(config-if)# exit
Device(config)# exit
Device#
clear counters
Clear "show interface" counters on all interfaces [confirm]
Device#
! Verify the configurations.
Device# show running-config interface FastEthernet3/1
Building configuration...
Current configuration : 114 bytes
!
interface FastEthernet3/1
no switchport
ipv6 address 1001::1/64
ipv6 traffic-filter hbh_acl
end
Consolidated Platform Configuration Guide, Cisco IOS Release 15.2(4)E (Catalyst 2960-X Switches)
1231
Configuration Examples for IPv6 ACLs