Cisco® CCNA Exam Cram Notes : Ipv6 Access-list

Retired Exam

Go to latest CCNA 200-301 Exam Cram Notes

7. Infrastructure Security

3. IPv6 access-list

The syntax for configuring ipv6 ACL is as given below:

deny | permit <protocol>
{ source-ipv6-prefix / prefix-length | any | host source-ipv6-address } [ operator [ port-number ]] {destination-ipv6-prefix/ prefix-length | any |
host destination-ipv6-address } [ operator [ port-number ]]
[ dscp value ] [ fragments ] [ log ] [ log-input ] [ sequence value ] [ time-range name ]

Example1: The command "deny tcp any any eq telnet" command restricts any host telnetting to any destination host

ipv6 access-list <access-list-name>

the command defines IPv6 access list name, and enter IPv6 access-list configuration mode.

Example2: deny ipv6 host 2001:db8:100::18 2001:db8:100::1/64

The statement deny ipv6 host 2001:db8:100::18 2001:db8:100::1/64 denies any ipv6 traffic with a source IP Address of - 2001:db8:100::18 that is destined for 2001:db8:100::1/64,

That is the IP Address must match exactly

Example3: To filter IPv6 traffic on an IOS device, you perform these steps

Step 1 : Create an IPv6 ACL, and enter IPv6 access list configuration mode.

Switch#configure terminal
Switch(config)#ipv6 access-list

Ex: Switch(config)#ipv6 access-list myipv6list
myipv6list is the list name.

Step 2 : Configure the IPv6 ACL to block (deny) or pass (permit) traffic, use the command:

Switch(config-ipv6-acl)#deny | permit protocol

Ex.: Switch(config-ipv6-acl)#permit icmp any any

Step 3 : Apply the IPv6 ACL to an interface. For router ACLs, you must also configure an IPv6 address on the Layer 3 interface to which the ACL is applied.

Step: 3.1
Switch# configure terminal
Switch(config)# interface

Ex: Switch(config)# interface gigabitethernet1/0/2

Switch(config-if)#no switchport ; this command enables switch interface for layer-3 operation.

Step 3.2 : ipv6 address <ipv6-address>

Ex: Switch(config-if)# ipv6 address 2001::/64 eui-64 

Here you assigned an ipv6 address to the interface.

Step 3.3 : ipv6 traffic-filter <access-list-name> { in | out }

Switch(config-if)# ipv6 traffic-filter myipv6list out 

here you applied the access-list to an out going interface.


IPV6 uses traffic-filter command filters traffic that is forwarded, not originated by router. To filter incoming or outgoing IPv6 traffic on an interface, use ipv6 traffic filter command in interface configuration mode.

yntax: R1 (config-if)#ipv6 traffic-filter <access-list-name> { in | out }

The commands are typically given while configuring router connectivity with an ISP.


IPv6 ACLs cannot be numbered they can only be configured as named access list

The command "permit tcp any host 2001:DB8:10:10::100 eq 25" command permits traffic from any host to an SMTP server on network 2001:DB8:10:10::/64

Some of the widely used port numbers are given below:

Port Number Description
21 FTP
22 SSH
23 Telnet
25 Simple mail Transfer Protocol

The command "show ipv6 access-lists" is given in the privileged EXEC mode. Given below is an example of the output and it shows IPv6 access lists configured on the switch.

Switch#show ipv6 access-list

IPv6 access list inbound
permit tcp any any eq eigrp (12 matches) sequence 10
permit tcp any any eq telnet (5 matches) sequence 20
permit udp any any sequence 30
IPv6 access list outbound
deny udp any any sequence 10
deny tcp any any eq telnet sequence 20

Previous    Contents    Next

CCNA Cram Notes Contents
certexams ad

simulationexams ad