Cisco IPv6 ACLs Configuration Guide: User Manual PDF (EN)

Restrictions for IPv6 ACLs

IPv6 ACLs Restrictions for IPv6 ACLs, on page 1 Information About IPv6 ACLs, on page 2 How to Configure an IPv6 ACL, on page 5 Monitoring IPv6 ACLs, on page 14 Configuration Examples for IPv6 ACL, on page 15 Feature History for IPv6 ACLs, on page 17 Restrictions for IPv6 ACLs IPv6 supports only named ACLs. With IPv4 ACLs, you can configure standard and extended numbered IP ACLs, named IP ACLs, and MAC ACLs. The switch supports most Cisco IOS-supported IPv6 ACLs with some exceptions: • The switch does not support matching on these keywords: flowlabel , routing header , and undetermined-transport . • The switch does not support reflexive ACLs (the reflect keyword).

• The vrf-also keyword is mutually exclusive of IPv6 access-class line command. • The switch does not apply MAC-based ACLs on IPv6 frames. • When configuring an ACL, there is no restriction on keywords that are entered in the ACL, regardless of whether they are supported or not on the platform. When you apply the ACL to an interface that requires hardware forwarding (physical ports or SVIs), the switch checks to determine whether ACL can be supported on the interface or not. If the ACL is not supported on the interface, the ACL is rejected.

• If an ACL is applied to an interface and you attempt to add an access control entry (ACE) with an unsupported keyword, the switch does not allow the ACE to be added to the ACL that is currently attached to the interface. • When you apply a scale ACL to an interface that does not program TCAM for a protocol and the ACLs that have been unloaded, it can impact the existing normal movement of traffic for other protocols. The restriction is applicable to IPv6 and MAC address traffic. • Time-to-live (TTL) classification is not supported on ACLs. IPv6 ACLs 1

Стр. 1

Supported ACLs

• If a downloadable ACL contains any type of duplicate entries, the entries are not auto merged. As a result, the 802.1X session authorization fails. Ensure that the downloadable ACL is optimized without any duplicate entries, for example port-based and name-based entries for the same port. • Egress ACL lookup is not supported for injected traffic that is forwarded by the software. • ACLs support only Layer 3 interfaces (such as routed interfaces and VLAN interfaces), , and subinterfaces. • ACL logging is not supported in SVL deployment on IPv6 Fully Qualified Domain Name (FQDN) ACLs The following restrictions apply to IPv6 FQDN ACLs:

• The dynamic host configuration is supported either at the source or destination host address, but not both at the same time. • An FQDN ACL configuration supports only up to 32767 ACL entries. • The number of ACEs that can be configured for FQDN ACLs are limited by the number of ACLs or ACEs supported on the device. • Object groups, reflexive ACLs, and time-range features are not supported in the FQDN ACE configuration. • Yang model is supported, but the configuration is limited till the destination port, along with log options. • Sequence number is mandatory for each rule or remark in the FQDN ACL.

• FQDN ACL rule configuration allows only the command formats that are displayed in the show running-config command output. • An FQDN or wildcard supports only 10000 mappings. Information About IPv6 ACLs The following sections provide information about IPv6 ACLs. IPv6 ACL Overview This topic provides an overview of IPv6 ACL. An access control list (ACL) is a set of rules that are used to limit access to a particular interface. ACLs are configured on the device and applied to the management interface and to any of the dynamic interfaces. You can also create a preauthentication ACL for web authentication. Such an ACL is used to allow certain types of traffic before authentication is complete.

IPv6 ACLs support the same options as IPv4 ACLs including source, destination, source, and destination ports. Supported ACLs The switch supports three types of ACLs to filter the traffic: IPv6 ACLs Information About IPv6 ACLs IPv6 ACLs 2

Стр. 2

IPv6 FQDN Redirect ACLs

• Port ACLs access-control traffic entering a Layer 2 interface. You can apply port ACLs to a Layer 2 interface in each direction to each access list type—IPv4 and MAC. • Router ACLs access-control traffic routed between VLANs and are applied to Layer 3 interfaces in a specific direction (inbound or outbound). • VLAN ACLs or VLAN maps are applied only to Layer 2 VLANs and impact bridged traffic only. You can use VLAN maps to filter traffic between devices in the same VLAN. VLAN maps are configured to provide access control based on Layer 3 addresses for IPv4. Unsupported protocols are access-controlled through MAC addresses using Ethernet ACEs.

After a VLAN map is applied to a VLAN, all packets (routed or bridged) entering the VLAN are checked against the VLAN map. Packets can either enter the VLAN through a switch port or through a routed port after being routed. Types of ACL The following sections provide information on the types of ACL: Per-User IPv6 ACL For the per-user ACL, the full access control entries (ACE) as the text strings are configured on the Cisco Secure Access Control Server (Cisco Secure ACS). Filter ID IPv6 ACL For the filter-Id ACL, the full ACEs and the acl name(filter-id) is configured on the device and only the filter-id is configured on the Cisco Secure ACS.

Downloadable IPv6 ACL For the downloadable ACL (dACL), all the full ACEs and the dacl name are configured only on the Cisco Secure ACS. The Cisco Secure ACS sends the dacl name to the device in its ACCESS-Accept attribute, which takes the dacl name and sends the dACL name back to the Cisco Secure ACS for the ACEs, using the ACCESS-request attribute. Switch Stacks and IPv6 ACLs The active switch supports IPv6 ACLs in hardware and distributes the IPv6 ACLs to the stack members. If a standby switch takes over as the active switch, it distributes the ACL configuration to all stack members.

The member switches sync up the configuration that is distributed by the new active switch and flush out entries that are not required. When an ACL is modified, attached to, or detached from an interface, the active switch distributes the change to all stack members. IPv6 FQDN Redirect ACLs An IPv6 FQDN redirect ACL can be configured with FQDN instead of the source or destination IP address. The FQDN is resolved based on the AAAA records in the DNS response sent to the corresponding client. IPv6 ACLs Types of ACL IPv6 ACLs 3

Стр. 3

VLAN Maps

This resolution is then shared across all IPv6 FQDN ACLs referring to that domain name. DNS response packets are held untill the resolved rule is programmed in the hardware. The FQDN Redirect ACLs section of the IPv4 ACLs chapter has more information that applies to IPv6 FQDN redirect ACLs also. ACL Precedence When VLAN maps, Port ACLs, and router ACLs are configured on the same switch, the filtering precedence, from greatest to least for ingress traffic is port ACL, VLAN map, and then router ACL. For egress traffic, the filtering precedence is router ACL, VLAN map, and then port ACL. The following examples describe simple use cases:

• When both an input port ACL and a VLAN map are applied, incoming packets that are received on ports with a port ACL applied are filtered by the port ACL. Other packets are filtered by the VLAN map • When an input router ACL and input port ACL exist in a switch virtual interface (SVI), incoming packets that are received on ports to which a port ACL is applied are filtered by the port ACL. Incoming routed IP packets received on other ports are filtered by the router ACL. Other packets are not filtered. • When an output router ACL and input port ACL exist in an SVI, incoming packets that are received on the ports to which a port ACL is applied are filtered by the port ACL.

Outgoing routed IP packets are filtered by the router ACL. Other packets are not filtered. • When a VLAN map, input router ACL, and input port ACL exist in an SVI, incoming packets that are received on the ports to which a port ACL is applied are only filtered by the port ACL. Incoming routed IP packets received on other ports are filtered by both the VLAN map and the router ACL. Other packets are filtered only by the VLAN map. • When a VLAN map, output router ACL, and input port ACL exist in an SVI, incoming packets that are received on the ports to which a port ACL is applied are only filtered by the port ACL. Outgoing routed IP packets are filtered by both the VLAN map and the router ACL.

Other packets are filtered only by the VLAN map. VLAN Maps VLAN ACLs or VLAN maps are used to control the network traffic within a VLAN. You can apply VLAN maps to all packets that are bridged within a VLAN in the switch or switch stack. VACLs are strictly for the security packet filtering and for redirecting traffic to specific physical interfaces. VACLs are not defined by direction (ingress or egress). All non-IP protocols are access-controlled through MAC addresses and Ethertype using MAC VLAN maps.

(IP traffic is not access-controlled by MAC VLAN maps.) You can enforce VLAN maps only on packets going through the switch; you cannot enforce VLAN maps on traffic between hosts on a hub or on another switch that is connected to this switch. With VLAN maps, forwarding of packets is permitted or denied, based on the action specified in the map. IPv6 ACLs ACL Precedence IPv6 ACLs 4

Стр. 4