Cisco Systems 3130 User Manual
35-2
Cisco Catalyst Blade Switch 3130 for Dell Software Configuration Guide
OL-13270-01
Chapter 35 Configuring IPv6 ACLs
Understanding IPv6 ACLs
Understanding IPv6 ACLs
A switch running the advanced IP services feature set supports two types of IPv6 ACLs:
•
IPv6 router ACLs are supported on outbound or inbound traffic on Layer 3 interfaces, which can be
routed ports, switch virtual interfaces (SVIs), or Layer 3 EtherChannels. IPv6 router ACLs apply
only to IPv6 packets that are routed.
routed ports, switch virtual interfaces (SVIs), or Layer 3 EtherChannels. IPv6 router ACLs apply
only to IPv6 packets that are routed.
•
IPv6 port ACLs are supported on inbound traffic on Layer 2 interfaces only. IPv6 port ACLs are
applied to all IPv6 packets entering the interface.
applied to all IPv6 packets entering the interface.
A switch running the IP services or IP base feature set supports only input router IPv6 ACLs. It does not
support port ACLs or output IPv6 router ACLs.
support port ACLs or output IPv6 router ACLs.
Note
If you configure unsupported IPv6 ACLs, an error message appears and the configuration does not take
affect.
affect.
On a switch running the IP base or IP services features set, if you create or apply an output router ACL
or an input port ACL, the ACL is added to the switch configuration but does not take effect; an error
message appears. If you want to use the output router ACL or input port ACL, save the switch
configuration and enable the advanced IP services feature set, which supports the ACL.
or an input port ACL, the ACL is added to the switch configuration but does not take effect; an error
message appears. If you want to use the output router ACL or input port ACL, save the switch
configuration and enable the advanced IP services feature set, which supports the ACL.
The switch does not support VLAN ACLs (VLAN maps) for IPv6 traffic.
Note
For more information about ACL support on the switch, see
You can apply both IPv4 and IPv6 ACLs to an interface.
As with IPv4 ACLs, IPv6 port ACLs take precedence over router ACLs:
•
When an input router ACL and input port ACL exist in an SVI, packets received on ports to which
a port ACL is applied are filtered by the port ACL. Routed IP packets received on other ports are
filtered by the router ACL. Other packets are not filtered.
a port ACL is applied are filtered by the port ACL. Routed IP packets received on other ports are
filtered by the router ACL. Other packets are not filtered.
•
When an output router ACL and input port ACL exist in an SVI, packets received on the ports to
which a port ACL is applied are filtered by the port ACL. Outgoing routed IPv6 packets are filtered
by the router ACL. Other packets are not filtered.
which a port ACL is applied are filtered by the port ACL. Outgoing routed IPv6 packets are filtered
by the router ACL. Other packets are not filtered.
Note
If any port ACL (IPv4, IPv6, or MAC) is applied to an interface, that port ACL is used to filter packets,
and any router ACLs attached to the SVI of the port VLAN are ignored.
and any router ACLs attached to the SVI of the port VLAN are ignored.
These sections describe some characteristics of IPv6 ACLs on the switch:
•
•
•