Filter
Top Products
35-4
Cisco Catalyst Switch Module 3110 and 3012 for IBM BladeCenter Software Configuration Guide
OL-12189-01
Chapter 35 Configuring IPv6 ACLs
Configuring IPv6 ACLs
• The switch does not apply MAC-based ACLs on IPv6 frames.
• You cannot apply IPv6 port ACLs to Layer 2 EtherChannels.
• Output router ACLs and input port ACLs for IPv6 are supported only when the Catalyst Switch
Module 3110 is running the advanced IP services feature set. A switch running the IP services or IP
base feature set supports only input router ACLs for IPv6 management traffic.
• When configuring an ACL, there is no restriction on keywords entered in the ACL, whether or not
they are supported on the platform. When you apply the ACL to an interface that requires hardware
forwarding (physical ports or SVIs), the switch determines whether or not the ACL can besupported
on the interface. If not, ACL attachment is rejected.
• If an ACL is applied to an interface and you attempt to add an access control entry (ACE) with an
unsupported keyword, the switch rejects the ACE addition to the ACL.
IPv6 ACLs and Switch Stacks
The stack master supports IPv6 ACLs in hardware and distributes the IPv6 ACLs to the stack members.
Note For full IPv6 functionality in a switch stack, all stack members must be running the advanced IP services
feature set. Switches running the IP services or IP base feature set support only input router IPv6 ACLs
for IPv6 management traffic.
If a new switch takes over as stack master, it distributes the ACL configuration to all stack members. The
member switches sync up the configuration distributed by the new stack master and flush out entries that
are not required.
When an ACL is modified, attached to, or detached from an interface, the stack master distributes the
change to all stack members.
Configuring IPv6 ACLs
Before configuring IPv6 ACLs, you must select one of the dual IPv4 and IPv6 SDM templates.
To filter IPv6 traffic, you perform these steps:
Step 1 Create an IPv6 ACL, and enter IPv6 access list configuration mode.
Step 2 Configure the IPv6 ACL to block (deny) or pass (permit) traffic.
Step 3 Apply the IPv6 ACL to an interface. For router ACLs, you must also configure an IPv6 address on the
Layer 3 interface to which the ACL is applied.
These sections describe how to configure and apply IPv6 ACLs:
• Default IPv6 ACL Configuration, page 35-5
• Interaction with Other Features and Switches, page 35-5
• Creating IPv6 ACLs, page 35-5
• Applying an IPv6 ACL to an Interface, page 35-8