35-3
Cisco Catalyst Switch Module 3110 and 3012 for IBM BladeCenter Software Configuration Guide
OL-12189-01
Chapter 35 Configuring IPv6 ACLs
Understanding IPv6 ACLs
• If you create or apply an output router ACL or an input port ACL on a switch running the IP base or
IP services feature set, the ACL is added to the switch configuration but does not take effect; an error
message appears. If you want to use the output router ACL or input port ACL, save the switch
configuration and enable the advanced IP services feature set, which supports the ACL.
• The switch does not support VLAN ACLs (VLAN maps) for IPv6 traffic.
Note For more information about ACL support on the switch, see Chapter 34, “Configuring Network
Security with ACLs.”
• You can apply both IPv4 and IPv6 ACLs to an interface.
• As with IPv4 ACLs, IPv6 port ACLs take precedence over router ACLs:
–
When an input router ACL and input port ACL are in an SVI, packets received on ports to which
a port ACL is applied are filtered by the port ACL. Routed IP packets received on other ports
are filtered by the router ACL. Other packets are not filtered.
–
When an output router ACL and input port ACL exist in an SVI, packets received on the ports
to which a port ACL is applied are filtered by the port ACL. Outgoing routed IPv6 packets are
filtered by the router ACL. Other packets are not filtered.
Note If any port ACL (IPv4, IPv6, or MAC) is applied to an interface, that port ACL is used to filter
packets, and any router ACLs attached to the SVI of the port VLAN are ignored.
• Routed or bridged packets with hop-by-hop options have IPv6 ACLs applied in software.
• Logging is supported for router ACLs, but not for port ACLs.
• The switch supports IPv6 address-matching for a full range of prefix lengths.
IPv6 ACLs on the Catalyst Switch Module 3012 have these characteristics:
• The switch supports only input router IPv6 ACLs applied to all IPv6 management packets entering
the Layer 3 interface.
• The switch does not support IPv6 port ACLs, output IPv6 router ACLs, or VLAN ACLs (VLAN
maps) for IPv6 traffic.
IPv6 ACL Limitations
With IPv4, you can configure standard and extended numbered IP ACLs, named IP ACLs, and MAC
ACLs. IPv6 supports only named ACLs.
The switch supports most Cisco IOS-supported IPv6 ACLs with these exceptions:
• IPv6 source and destination addresses—ACL matching is supported only on prefixes from /0 to /64
and host addresses (/128) that are in the extended universal identifier (EUI)-64 format. The Catalyst
Switch Module 3012 supports only these host addresses:
–
aggregatable global unicast addresses
–
link local addresses
• The switch does not support matching on these keywords: flowlabel, routing header, and
undetermined-transport.
• The switch does not support reflexive ACLs (the reflect keyword).
