This is the first instance of IPv6 addressing in an ACE. It follows the protocol specifier and defines the source IPv6 address (SA) a packet must carry for a match with the ACE.



Allows IPv6 packets from any IPv6 SA.

host SA

Specifies only packets having a single address as the SA. Use this criterion when you want to match only the IPv6 packets from a single SA.

SA prefix-length

Specifies packets received from one or more contiguous subnets or contiguous addresses within a single subnet. The prefix length is in CIDR format and defines the number of leftmost bits to use in determining a match.


Prefix-length applications:

  • 2001:db8:0:e102::10:100/120 matches any IPv6 address in the range of 2001:db8:0:e102::10:<0100 - 01FF>

  • 2001:db8:a0:e102::/64 matches any IPv6 address having a prefix of 2001:db8:a0:e102.

  • FE80::/16 matches any link-local address on an interface.