CLI Reference Guide-R07

Chapter 10 | Access Control Lists
IPv6 ACLs
– 343 –
prefix-length - A decimal value indicating how many contiguous bits (from
the left) of the address comprise the prefix; i.e., the network portion of the
address. (Range: 0-128 for source prefix, 0-128 for destination prefix)
dscp – DSCP traffic class. (Range: 0-63)
next-header – Identifies the type of header immediately following the IPv6
header. (Range: 0-255)
sport – Protocol
5
source port number. (Range: 0-65535)
dport – Protocol
4
destination port number. (Range: 0-65535)
port-bitmask – Decimal number representing the port bits to match.
(Range: 0-65535)
time-range-name - Name of the time range. (Range: 1-32 characters)
Default Setting
None
Command Mode
Extended IPv6 ACL
Command Usage
◆ All new rules are appended to the end of the list.
◆ Optional internet-layer information is encoded in separate headers that may be
placed between the IPv6 header and the upper-layer header in a packet. There
are a small number of such extension headers, each identified by a distinct Next
Header value. IPv6 supports the values defined for the IPv4 Protocol field in RFC
1700, including these commonly used headers:
0 : Hop-by-Hop Options (RFC 2460)
6 : TCP Upper-layer Header (RFC 1700)
17 : UDP Upper-layer Header (RFC 1700)
43 : Routing (RFC 2460)
44 : Fragment (RFC 2460)
51 : Authentication (RFC 2402)
50 : Encapsulating Security Payload (RFC 2406)
60 : Destination Options (RFC 2460)
Example
This example accepts any incoming packets if the destination address is
2009:DB9:2229::79/8.
Console(config-ext-ipv6-acl)#permit any 2009:db90:2229::79/8
Console(config-ext-ipv6-acl)#
5. Includes TCP and UDP.