Security
IPv6 Access Control Lists
IPv6 ACLs are always named, use a different syntax than IPv4 ACLs, and include implicit permit statements required for neighbor discovery to function.
What you need to know
- IPv6 ACLs support only the named format; there is no numbered IPv6 ACL.
- Every IPv6 ACL implicitly permits neighbor discovery (NS/NA) and ICMPv6 link-local traffic needed for ND, in addition to the implicit deny ipv6 any any at the end.
- IPv6 ACLs are applied with ipv6 traffic-filter, not ip access-group.
- IPv6 ACL syntax combines standard and extended-style matching into a single command: permit|deny protocol source destination.
- Prefix length notation (::/0, /64) is used instead of wildcard masks.
- IPv6 ACLs can filter on protocol, port, DSCP, flow label, and other IPv6-specific fields.
- Applying an IPv6 ACL that blocks ICMPv6 ND explicitly can break address resolution on the segment.
Configuration commands
| Command | Mode | Purpose |
|---|---|---|
| ipv6 access-list BLOCK-TELNET | config | Create a named IPv6 ACL and enter ACL configuration mode. |
| deny tcp any any eq 23 | config-acl | Deny Telnet over IPv6 inside the ACL. |
| permit ipv6 any any | config-acl | Permit all other IPv6 traffic explicitly. |
| ipv6 access-list RESTRICT | config | Create another named IPv6 ACL. |
| permit icmp any any nd-ns | config-acl | Explicitly permit neighbor solicitation if default ND permits were overridden. |
| permit icmp any any nd-na | config-acl | Explicitly permit neighbor advertisement. |
| deny ipv6 2001:db8:1::/64 any | config-acl | Deny a specific IPv6 source prefix. |
| interface gi0/1 | config | Enter interface configuration to apply the IPv6 ACL. |
| ipv6 traffic-filter RESTRICT in | config-if | Apply the IPv6 ACL inbound on the interface. |
Verify it
- show ipv6 access-list
- show ipv6 interface gi0/1
- show running-config | section ipv6 access-list
- show ipv6 neighbors
Common mistakes
- Trying to create a numbered IPv6 ACL, which does not exist.
- Using ip access-group instead of ipv6 traffic-filter to apply the list.
- Explicitly denying icmp any any without permitting ND first, breaking neighbor discovery on the link.
- Forgetting the implicit deny ipv6 any any and being surprised traffic is dropped.
- Assuming wildcard masks work the same way as IPv6 prefix length matching.
Practise IPv6 Access Control Lists in a real CLI
Generated labs, graded against the simulated network state.