Cisco Catalyst 4500 Series Software Configuration Guide

62-19
Catalyst 4500 Series Switch, Cisco IOS Software Configuration Guide - Cisco IOS XE 3.9.xE and IOS 15.2(5)Ex
Chapter 62 Configuring Network Security with ACLs
Configuring Named IPv6 ACLs
Beginning with IOS XE 3.7.0, you can employ IPv6 wildcard masking when specifying the Layer 3
address of a IPv6 ACL entry. Scale and performance issues that might be introduced by this feature are
captured in the following:
http://www.cisco.com/c/en/us/products/switches/catalyst-4500-series-switches/datasheet-listing.html
The following document covers all security related hardware TCAM resources: “Cisco Catalyst 4500E
Supervisor Engine 8-E: Wired and Wireless Convergence Data Sheet”
http://www.cisco.com/c/en/us/products/collateral/switches/catalyst-4500-series-switches/data_sheet_c
78-728191.html
Note routing-type/mobility-type extension header options in an IPv6 ACL have never been supported, but
were previously configurable. As of Release IOS XE 3.4.0SG and IOS 15.1(2)SG, configuration of these
options has been removed.
.To create a named IPv6 ACLs, perform this task:
The following example shows how to create and display an IPv6 access list named v6test, denying only
one IPv6 traffic with one particular source and destination address, but permitting all other types of IPv6
traffic:
Switch(config)# ipv6 access-list v6test
Switch(config-ipv6-acl)# deny ipv6 host 2020::10 host 2040::10
Switch(config-ipv6-acl)# permit any any
Switch(config-ipv6-acl)# end
Switch# show ipv6 access-list
IPv6 access list v6test
deny ipv6 host 2020::10 host 2040::10 sequence 10
permit ipv6 any any sequence 20
Command Purpose
Step 1
Switch# configure terminal
Enters global configuration mode.
Step 2
Switch(config)# ipv6 access-list name
Defines an IPv6 access list using a name and enters access-list
configuration mode.
To delete the IPv6 ACL, use the no form of the command. You can
also delete individual ACEs from the IPv6 access list.
Step 3
Switch(config-ipv6-acl)# { deny | permit
} { any | proto | object-group
service-object-group-name} { host
ipv6-addr | ipv6-prefix | ipv6-addr
ipv6-wildcard-bits | object-group
source-network-object-group-name} { host
ipv6-addr | ipv6-prefix | ipv6-addr
ipv6-wildcard-bits | object-group
dest-network-object-group-name}
Specifies one or more IPv6 ACEs. Repeat this step to define
multiple ACEs.
You can specify an IPv6 address or use a wildcard mask to specify
addresses. If you use a wildcard, the address should be specified in
hexadecimal format, using 16-bit values between colons. (See
RFC 2373).
Note 0 is the care bit and must match; 1 is the don't care bit and
the system does not care whether it matches.
Step 4
Switch(config-ipv6-acl)#
hardware statistics
(Optional) Enables hardware statistics for the IPv6 ACL.
Step 5
Switch(config-ipv6-acl)# end
Returns to privileged EXEC mode.
Step 6
Switch# show ipv6 access-list
Display the IPv6 access list configuration.

Cisco Catalyst 4500 Series Specifications

General

Series	Catalyst 4500 Series
Category	Switch
Layer Support	Layer 2, Layer 3
Form Factor	Modular chassis
Stackable	No
Chassis Slots	3, 6, 7, 10
Power Supply Options	AC, DC
Redundancy	Power supply, Supervisor engine
Network Management	Cisco IOS Software CLI, SNMP, Cisco Prime Infrastructure
Features	Security, QoS
Port Density	Up to 384 ports per chassis
Security Features	802.1X, ACLs, DHCP Snooping, Dynamic ARP Inspection, IP Source Guard
Supervisor Engine	8-E