ZXR10 5900E Series Configuration Guide (IPv6)
Figure 4-1 IPv6 ACL Configuration Example
In this case, it is only necessary to create one ACL and add the following rule to this
ACL: Deny the telnet packets matching the IP address of PC2 and using the protocol type
TCP and the port type telnet. Then bind the ACL to the ingress direction of the interface
gei-0/1/1/3 or the egress direction of the interface gei-0/1/1/4.
After the above configuration is completed, the requests initiated by PC2 will not reach S1
but will be discarded when they reach S2 even if PC2 has obtained the telnet username
and password of S1. The other communications of S1 and PC2, however, will not be
affected.
Method
1.
First create an ipv6-access-list. During the creation, a customized name can be
assigned to this list but the length of the name shall not exceed 31 characters.
2.
Enter the IPv6 ACL configuration mode after the list is created and then add rules. A
packet type can be specified for each rule, and the permit or deny action applies to
the packet type.
3.
Bind the customized ipv6-access-list to the ingress or egress direction of the interface
to which traffic filtering applies.
Steps
S2 configuration:
S2(config)#ipv6-access-list test
S2(config-ipv6-acl)#rule deny tcp 100:1::1:2/128 eq 23 110:1::1:2/128
S2(config-ipv6-acl)#rule permit ip any any
S2(config-ipv6-acl)#exit
S2(config)#ipv6-access-group gei-0/1/1/3 ingress test
Verification
Check the configured ACL in one of the following three modes:
/*Check all the ACLs on the router. In this mode, all the names
and number of ACLs are shown.*/
4-10
SJ-20150114102049-011|2015-01-15 (R1.0)
ZTE Proprietary and Confidential
