What is different about IPv6 ACLs on Cisco IOS?
Show the answer
Say this first
They are always named, use prefix lengths instead of wildcards, and are applied with
ipv6 traffic-filter NAME in|out instead of ip access-group. The important difference is the end of
the list: before the implicit deny ipv6 any any there are implicit permits for Neighbor Discovery
neighbor solicitations and advertisements. If I add my own deny ipv6 any any log, I block ND and
neighbors stop resolving, so I add the ND permits explicitly above it.
Go deeper
Example
ipv6 access-list V6-SERVERS-IN
permit tcp 2001:db8:10::/64 host 2001:db8:50::10 eq 443
permit icmp any any nd-ns
permit icmp any any nd-na
permit icmp any any packet-too-big
deny ipv6 any any log
!
interface GigabitEthernet0/0/1
ipv6 traffic-filter V6-SERVERS-IN in
!
line vty 0 15
ipv6 access-class V6-MGMT inWhy ICMPv6 needs more care than ICMP in IPv4
- Neighbor Discovery replaces ARP and runs over ICMPv6.
- Packet Too Big drives path MTU discovery. Routers never fragment IPv6, so blocking it causes black holes for large packets.
- Router Advertisements carry the default gateway and prefixes for SLAAC. RFC 4890 gives recommendations for which ICMPv6 types to allow through firewalls.
The dual stack hole
An IPv4 ACL does not touch IPv6. A dual-stack interface with only ip access-group lets all IPv6
through. Every IPv4 policy needs an IPv6 twin.
They will ask next
How do you see hits on an IPv6 ACL?
show ipv6 access-list V6-SERVERS-INshows each line with its match count and sequence number.Do hosts use IPv6 even if you never configured it?
Yes. Windows, macOS and Linux enable IPv6 by default and prefer it when they get a global address. An unfiltered segment can be reached over IPv6 link-local and by rogue router advertisements, which is why RA Guard exists.
Traps
- Adding an explicit
deny ipv6 any any logand breaking Neighbor Discovery. - Filtering IPv4 carefully and forgetting IPv6 on the same interface.