13
Figure 2 Network diagram
Configuration procedure
# Create a periodic time range from 8:00 to 18:00 on working days.
<RouterA> system-view
[RouterA] time-range work 8:0 to 18:0 working-day
# Create an IPv6 advanced ACL numbered 3000 and configure three rules in the ACL. One rule
permits access from the President office to the database server, one rule permits access from the
Financial department to the database server during working hours, and one rule denies access from
other departments to the database server.
[RouterA] acl ipv6 number 3000
[RouterA-acl6-adv-3000] rule permit ipv6 source 1001:: 16 destination 1000::100 128
[RouterA-acl6-adv-3000] rule permit ipv6 source 1002:: 16 destination 1000::100 128
time-range work
[RouterA-acl6-adv-3000] rule deny ipv6 source any destination 1000::100 128
[RouterA-acl6-adv-3000] quit
# Enable IPv6 firewall, and apply IPv6 advanced ACL 3000 to filter outgoing IPv6 packets on
interface GigabitEthernet 1/0/1.
[RouterA] firewall ipv6 enable
[RouterA] interface gigabitethernet 1/0/1
[RouterA-GigabitEthernet1/0/1] firewall packet-filter ipv6 3000 outbound
Verifying the configuration
# Ping the database server from a PC in the Financial department during working hours. (All PCs in
this example use Windows XP.)
C:\> ping 1000::100
Pinging 1000::100 with 32 bytes of data:
Reply from 1000::100: time<1ms
Reply from 1000::100: time<1ms
Reply from 1000::100: time<1ms
Reply from 1000::100: time<1ms
President office
1001::/16
Financial department
1002::/16
Marketing department
1003::/16
Device A
GE1/0/1
GE1/0/4
GE1/0/2
GE1/0/3
Financial database server
1000::100/16