Inserts filtering rules in IPv6 access lists (ACLs).
IP ACL config mode
Important
If you configure an IPv4 or IPv6 ACL rule to match a specific IP length and also configure an IPv4 or IPv6 ACL with an overlapping IP length range, then the rule with specific length will not work.IPvn rules configured with specified lengths that overlap IPvn length-range configurations fail silently.
Example 1. The IPv6 ACL rule in this example will not work because the rule with a specific length (bold font) overlaps the configured IP ACL range from 100 through 200. The rule with the overlapping specified length fails silently.
ip access-list v4acl seq 10 permit ip any 1.0.0.1 255.255.255.0 length 100 length-end 200 ipv6 access-list v6acl seq 10 permit ipv6 any bbbb::bbbb ffff::ffff length 150
Example 2. The IPv6 ACL rule (bold font) in this example will not work because the rule with a specific length overlaps the range from 100 through 200. The rule with the overlapping specified length fails silently.
ipv6 access-list v6acl seq 10 permit ipv6 any aaaa::aaaa ffff::ffff length 100 length-end 200 seq 20 permit ipv6 any bbbb::bbbb ffff::ffff length 150
Example 3. This IPv6 ACL rule example will not work because in this configuration, because the rule with a specific length (bold font) overlaps the range from 100 through 200. The rule with the overlapping specified length fails silently.
ipv6 access-list v6acl-1 seq 10 permit ipv6 any aaaa::aaaa ffff::ffff length 100 length-end 200 ipv6 access-list v6acl-2 seq 10 permit ipv6 any bbbb::bbbb ffff::ffff length 150
Message | Reason |
---|---|
Error: seqid 10 already exist ip1. | Sequence ID is repeated within IP ACL named ip1. |
Error: valid range for VNID is 1-16777215. | VNID range exceeds for VxLAN protocol. |
Error: valid range for VSID is 1-16777215. | VSID range exceeds for NVGRE protocol. |
Error: source ip address must be in X:X:X:X:X:X:X:X or X:X::X:X format. Each X can be up to 4 hexa-decimal digits. Example: 2001:0:0:0:0:0:0:1 or 2001::1 | IPv6 format must be used.. |
% Value '65536' not in range <1-65535>. | Example: Sequencel-id range error. |
% Value '255' not in range <0-254>. | Example: Custom Protocol Number range error. |
% Value '4294967296' not in range <1-4294967295>. | Example: Tunnel-id range error (ngvre, gtpu, vxlan). |
% Value '65536' not in range <1-65535>. | Example: Source port range error. |
% Value '9001' not in range <64-9000>. | Example: Length errors. |
The following example configures IPv6 ACL, P6 and verification with the show
running-config
command.
device# configure terminal device(config)#ipv6 access-list P6 device(config-ipv6-acl)# seq 1 permit 2000::1 FFFF::1 any any count log device(config-ipv6-acl)# device# show running-config access-list ipv6 access-list ip6-acl seq 10 permit ipv6 2001::1 2001::0 2002::2 2002::0