ACL configuration structure

General structure options for an IPv6 ACL

After you enter an ACL command, you may want to inspect the resulting configuration. This is especially true where you are entering multiple ACEs into an ACL. Also, it will be helpful to understand the configuration structure when using later sections in this chapter.

Individual ACEs in an IPv6 ACL include:
  • Optional remark statements

  • A permit/deny statement

  • Source and destination IPv6 addressing

  • Choice of IPv6 criteria

  • Optional ACL log command (for deny entries)

ipv6 access-list <identifier>

 [seq–#]

 [remark <remark–str]

 <permit|deny>
    0–255
    esp
    ah
    sctp
    icmp
    <SA>  [operator <value>]
    <DA>  [operator <value>][type [code]|icmp–msg] [dscp <codepoint|precedence>]
    ipv6
    tcp
    <SA>  [operator <value>]
    <DA>  [operator <value>]
            [dscp <codepoint|precedence]
            [established]
            [ack|fin|rst|syn]
       udp
    <SA>  [operator <value>]
    <DA>  [operator <value>] [dscp <codepoint|precedence>]

     [log]
    . . .
     <Implicit Deny Any Any> 
    exit
      

The ACL in the example below filters traffic for individual hosts in some instances and all hosts in others:

Displayed ACL configuration

Switch# show run
.
.
.
ipv6 access-list "Sample–List–1"
   10 permit ipv6 2001:db8:0:130::55/128 2001:db8:0:130::240/128
   20 permit tcp ::/0 ::/0 eq 23
   30 remark "ALLOWS HTTP FROM SINGLE HOST."
   30 permit tcp 2001:db8:0:140::14/128 eq 80 ::/0 eq 3871
   40 remark "DENIES HTTP FROM ANY TO ANY."
   40 deny tcp ::/0 ::/0 eq 80 log
   50 deny udp 2001:db8:0:150::44/128 eq 69 2001:db8:0:120::19/128
               range 3680 3690 log
   60 deny udp ::/0 2001:db8:0:150::121/128 log
   70 permit ipv6 2001:db8:0:01::/56 ::/0
   exit

Line

Action

10

Permits all IPv6 traffic from the host at 2001:db8:0:130::55 to the host at 2001:db8:0:130::240.

20

Permits all Telnet traffic from any source to any destination.

30

Includes a remark and permits TCP port 80 traffic received at any destination as port 3871 traffic.

40

Includes a remark and denies TCP port 80 traffic received at any destination, and causes a log message to be generated when a match occurs.

50

Denies UDP port 69 (TFTP) traffic sent from the host at 2001:db8:0:150::44 to the host at 2001:db8:0:120::19 with a destination port number in the range of 3680–3690 and causes a log message to be generated when a match occurs.

60

Denies UDP traffic from any source to the host at 2001:db8:0:150::121 and causes a log message to be generated when a match occurs.

70

Permits all IPv6 traffic with an SA prefix of 2001:db8:0:01/56 that is not already permitted or denied by the preceding ACEs in the ACL.

NOTE:

An implicit deny IPv6 any any is automatically applied following the last line (70, in this case) and denies all IPv6 traffic not already permitted or denied by the ACEs in lines 10 through 70.

  1. ACL identity: This is a string of up to 64 characters specifying the ACL name.

  2. Optional remark entries.

  3. One or more deny/permit list entries (ACEs): One entry per line.

    Element

    Notes

    Identifier

    Alphanumeric; up to 64 characters, including spaces

    Remark

    Allows up to 100 alphanumeric characters, including blank spaces. (If any spaces are used, the remark must be enclosed in a pair of single or double quotes.)A remark is associated with a particular ACE and has the same sequence number as the ACE. (One remark is allowed per ACE.) See Attaching a remark to an ACE.

    Maximum ACEs per switch

    The maximum number of ACEs supported by the switch is up to 3072 for IPv6 ACEs and up to 3072 for IPv4 ACEs. The maximum number of ACEs applied to a VLAN or port depends on the concurrent resource usage by multiple configured features. For more information, use the show <qos|access-list> resources command.

  4. Implicit deny: Where an ACL is applied to an interface, it denies any packets that do not have a match with any of the ACEs explicitly configured in the list. The implicit deny does not appear in ACL configuration listings, but always functions when the switch uses an ACL to filter packets. (You cannot delete the implicit deny, but you can supersede it with a permit ipv6 any any ACE.)