KB.15.15

bits—those to the right of the bits specified by the prefix length—comprise a wildcard

and can be either on or off.

See also Prefix Length.

Overview

Types of IPv6 ACLs

A permit or deny policy for IPv6 traffic you want to filter is based on source and destination IPv6

address, plus other IPv6 protocol factors such as TCP/UDP, ICMP, and DSCP.

Concurrent IPv4 and IPv6 ACLs

The switches support concurrent configuration and operation of IPv4 and IPv6 ACLs. For information

on IPv4 ACLs, see the Access Security Guide for your switch.

IPv6 ACL applications

ACL filtering is applied to IPv6 traffic as follows:

• Routed ACL (RACL)—on a VLAN configured with an RACL, filters:

Routed IPv6 traffic entering or leaving the switch. (Routing can be between different VLANs

or between different subnets in the same VLAN. IPv6 routing must be enabled.)

•

• Routed IPv6 traffic having a DA on the switch itself. In Figure 3 (page 94), this is any of

the IPv6 addresses shown in VLANs "A", "B", and "C". (IPv6 routing need not be enabled.)

• Filters outbound traffic generated by the switch itself if the ACL is applied to outbound

traffic.

• VLAN ACL (VACL): On a VLAN configured with a VACL, filters inbound IPv6 traffic, regardless

of whether it is switched or routed.On a multinetted VLAN, this includes inbound IPv6 traffic

from any subnet.

• Static port ACL: Filters inbound IPv6 traffic on the port.

• RADIUS-assigned ACL: On a port having an ACL assigned by a RADIUS server to filter an

authenticated client's traffic, filters inbound IPv4 and IPv6 traffic (or IPv4-only traffic) from that

client

For information on RADIUS-assigned ACLs, see chapter "Configuring RADIUS Server Support

for Switch Services" in the latest Access Security Guide for your switch.

RACL applications

RACLs filter routed IPv6 traffic entering or leaving the switch on VLANs configured with the "in"

and/or "out" ACL option:

vlan vid ipv6 access-group identifier [ in | out | vlan ]

interface tunnel tunnel-id ipv6 access-group identifier [ in | out ]

Overview 93