IPv6 ACL operation

An ACL is a list of one or more Access Control Entries (ACEs), where each ACE consists of a matching criteria and an action (permit or deny). An ACL applies only to the switch in which it is configured. ACLs operate on assigned interfaces, and offer these traffic filtering options:
  • IPv6 traffic inbound/outbound on a port.

  • IPv6 traffic inbound/outbound on a VLAN.

  • Routed IPv6 traffic entering or leaving the switch on a VLAN. (Note that ACLs do not screen traffic at the internal point where traffic moves between VLANs or subnets within the switch).

The following table lists the range of interface options:

Interface

ACL Application

Application Point

Filter Action

Port

Static Port ACL (switch configured) RADIUS-assigned ACL1

inbound/outbound on the switch port inbound/outbound on the switch port used by authenticated client

inbound/outbound IPv6 traffic inbound/outbound IPv6 traffic from the authenticated client

VLAN

VACL

entering or leaving the switch on the VLAN

inbound or outbound IPv6 traffic

NOTE:

After you assign an ACL to an interface, the default action on the interface is to implicitly deny any IPv6 traffic that is not specifically permitted by the ACL. (This applies only in the direction of traffic flow filtered by the ACL.)