2-71
Catalyst 3750 Metro Switch Command Reference
OL-9645-10
Chapter 2 Catalyst 3750 Metro Switch Cisco IOS Commands
deny (IPv6 access-list configuration)
Usage Guidelines
The
deny
(IPv6 access-list configuration mode)
command is similar to the
deny
(IPv4 access-list
configuration mode) command, but it is IPv6-specific.
Use the
deny
(IPv6)
command after the
command to enter IPv6 access list configuration
mode and to define the conditions under which a packet passes the access list.
Specifying IPv6 for the
protocol
argument matches the IPv6 header of the packet.
By default, the first statement in an access list is number 10, and the subsequent statements are numbered
in increments of 10.
You can add
permit
,
deny
, or
remark
statements to an existing access list without re-entering the entire
list. To add a new statement somewhere other than at the end of the list, create a new statement with an
appropriate entry number between two existing entry numbers to show where it belongs.
Note
Every IPv6 ACL has implicit
permit icmp any any nd-na
,
permit icmp any any nd-ns
, and
deny ipv6
any any
statements as its last match conditions. The two
permit
conditions allow ICMPv6 neighbor
discovery. To disallow ICMPv6 neighbor discovery and to deny
icmp any any nd-na
or
icmp any any
nd-ns
, there must be an explicit
deny
entry in the ACL. For the three implicit statements to take effect,
an IPv6 ACL must contain at least one entry.
The IPv6 neighbor discovery process uses the IPv6 network layer service. Therefore, by default, IPv6
ACLs implicitly allow IPv6 neighbor discovery packets to be sent and received on an interface. In IPv4,
the Address Resolution Protocol (ARP), which is equivalent to the IPv6 neighbor discovery process, uses
a separate data-link layer protocol. Therefore, by default, IPv4 ACLs implicitly allow ARP packets to
be sent and received on an interface.
Both the
source-ipv6-prefix
/
prefix-length
and
destination-ipv6-prefix
/
prefix-length
arguments are used
for traffic filtering. (The
source
prefix filters traffic based upon its source; the
destination
prefix filters
traffic based upon its destination.)
The switch supports IPv6 address matching for a full range of prefix lengths.
The
fragments
keyword is an option only if the protocol is
ipv6
and the
operator
[
port-number
]
arguments are not specified.
This is a list of ICMP message names:
beyond-scope
destination-unreachable
echo-reply
echo-request
header
hop-limit
mld-query
mld-reduction
mld-report
nd-na
nd-ns
next-header
no-admin
no-route
packet-too-big
parameter-option
parameter-problem
port-unreachable
reassembly-timeout
renum-command
renum-result
renum-seq-number
router-advertisement
router-renumbering
