To Next Page

To Previous Page

38-3

Catalyst 3750-X and 3560-X Switch Software Configuration Guide

OL-21521-01

Chapter 38 Configuring IPv6 ACLs

Understanding IPv6 ACLs

• Routed or bridged packets with hop-by-hop options have IPv6 ACLs applied in software.

• Logging is supported for router ACLs, but not for port ACLs.

• The switch supports IPv6 address-matching for a full range of prefix-lengths.

IPv6 ACL Limitations

With IPv4, you can configure standard and extended numbered IP ACLs, named IP ACLs, and MAC

ACLs. IPv6 supports only named ACLs.

The switch supports most Ci

sco IOS-supported IPv6 ACLs with some exceptions:

• The switch does not support matching on these keywords: flowlabel, routing header, and

undetermined-transport.

• The switch does not support reflexive ACLs (the reflect keyword).

• This release supports only port ACLs and router ACLs for IPv6; it does not support VLAN ACLs

(VLAN maps).

• The switch does not apply MAC-based ACLs on IPv6 frames.

• You cannot apply IPv6 port ACLs to Layer 2 EtherChannels.

• The switch does not support output port ACLs.

• Output router ACLs and input port ACLs for IPv6 are supported only on switch stacks. Switches

support only control plane (incoming) IPv6 ACLs.

• When configuring an ACL, there is no restriction on keywords entered in the ACL, regardless of

whether or not they are supported on the platform. When you apply the ACL to an interface that

requires hardware forwarding (physical ports or SVIs), the switch checks to determine whether or

not the ACL can be supported on the interface. If not, attaching the ACL is rejected.

• If an ACL is applied to an interface and you attempt to add an access control entry (ACE) with an

unsupported keyword, the switch does not allow the ACE to be added to the ACL that is currently

attached to the interface.

IPv6 ACLs and Switch Stacks

The stack master supports IPv6 ACLs in hardware and distributes the IPv6 ACLs to the stack members.

Note For full IPv6 functionality in a switch stack, all stack members must be running the IP services feature

set.

If a new switch takes over as stack master, it distributes the ACL configuration to all stack members. The

member switches sync up the configuration distributed by the new stack master and flush out entries that

are not required.

When an ACL is modified, atta

ched to, or detached from an interface, the stack master distributes the

change to all stack members.

Cisco Catalyst 3750-X User Manual

Other manuals for Cisco Catalyst 3750-X