62-19
Catalyst 4500 Series Switch, Cisco IOS Software Configuration Guide - Cisco IOS XE 3.9.xE and IOS 15.2(5)Ex
Chapter 62 Configuring Network Security with ACLs
Configuring Named IPv6 ACLs
Beginning with IOS XE 3.7.0, you can employ IPv6 wildcard masking when specifying the Layer 3
address of a IPv6 ACL entry. Scale and performance issues that might be introduced by this feature are
captured in the following:
http://www.cisco.com/c/en/us/products/switches/catalyst-4500-series-switches/datasheet-listing.html
The following document covers all security related hardware TCAM resources: “Cisco Catalyst 4500E
Supervisor Engine 8-E: Wired and Wireless Convergence Data Sheet”
Note
routing-type
/
mobility-type
extension header options in an IPv6 ACL have never been supported, but
were previously configurable. As of Release IOS XE 3.4.0SG and IOS 15.1(2)SG, configuration of these
options has been removed.
.To create a named IPv6 ACLs, perform this task:
The following example shows how to create and display an IPv6 access list named v6test, denying only
one IPv6 traffic with one particular source and destination address, but permitting all other types of IPv6
traffic:
Switch(config)#
ipv6 access-list v6test
Switch(config-ipv6-acl)#
deny ipv6 host 2020::10
host 2040::10
Switch(config-ipv6-acl)#
permit any any
Switch(config-ipv6-acl)#
end
Switch#
show ipv6 access-list
IPv6 access list v6test
deny ipv6 host 2020::10 host 2040::10 sequence 10
permit ipv6 any any sequence 20
Command
Purpose
Step 1
Switch#
configure terminal
Enters global configuration mode.
Step 2
Switch(config)#
ipv6 access-list
name
Defines an IPv6 access list using a name and enters access-list
configuration mode.
To delete the IPv6 ACL, use the
no
form of the command. You can
also delete individual ACEs from the IPv6 access list.
Step 3
Switch(config-ipv6-acl)# {
deny
|
permit
} {
any
|
proto
|
object-group
service-object-group-name
} {
host
ipv6-addr
|
ipv6-prefix
|
ipv6-addr
ipv6-wildcard-bits
|
object-group
source-network-object-group-name
} {
host
ipv6-addr
|
ipv6-prefix
|
ipv6-addr
ipv6-wildcard-bits
|
object-group
dest-network-object-group-name
}
Specifies one or more IPv6 ACEs. Repeat this step to define
multiple ACEs.
You can specify an IPv6 address or use a wildcard mask to specify
addresses. If you use a wildcard, the address should be specified in
hexadecimal format, using 16-bit values between colons. (See
RFC 2373).
Note
0 is the care bit and must match; 1 is the
don't care
bit and
the system does not care whether it matches.
Step 4
Switch(config-ipv6-acl)#
hardware statistics
(Optional) Enables hardware statistics for the IPv6 ACL.
Step 5
Switch(config-ipv6-acl)#
end
Returns to privileged EXEC mode.
Step 6
Switch#
show ipv6 access-list
Display the IPv6 access list configuration.
Summary of Contents for Catalyst 4500 Series
Page 2: ......
Page 4: ......
Page 2086: ...Index IN 46 Software Configuration Guide Release IOS XE 3 9 0E and IOS 15 2 5 E ...
