LogoفارسیFA

Hands-On Lab: Configuring an IPv6 Access Control List

This hands-on lab configures an IPv6 ACL to permit only specific traffic between two networks, applying it to an interface and verifying both permitted and denied IPv6 traffic behave as expected.

IPv6 ACL Configurationipv6 access-listIPv6 Traffic Filtering

~3 min read · Updated Sep 23, 2026

Lab Objective

Configure a named IPv6 ACL permitting only ICMPv6 and HTTPS traffic from a specific internal subnet, apply it to an interface, and verify both allowed and blocked IPv6 traffic behave correctly.

Lab Purpose

IPv6 ACLs follow the same conceptual logic as the IPv4 ACLs covered earlier in this series, but use IPv6-specific syntax and are always named rather than numbered — understanding this parallel structure lets an engineer apply existing ACL knowledge directly to dual-stack environments.

Lab Topology

R1
  Gi0/0: 2001:DB8:E:1::1/64 (internal LAN)
  Gi0/1: 2001:DB8:E:2::1/64 (toward destination
                              server subnet)

Task 1: Configure Basic IPv6 Addressing

Enable IPv6 routing and configure both interfaces as shown.

Task 2: Create a Named IPv6 ACL

Create an IPv6 ACL named IPV6-FILTER permitting ICMPv6 and HTTPS (port 443) from the internal LAN prefix to any destination, denying everything else.

Task 3: Apply the ACL to the Interface

Apply IPV6-FILTER inbound on Gi0/0.

Task 4: Verify Permitted Traffic

Confirm an internal host can successfully ping (ICMPv6) and reach an HTTPS server on the destination subnet.

Task 5: Verify Denied Traffic

Confirm the same internal host cannot reach an HTTP (port 80) server on the destination subnet.

Solution and Verification

R1(config)# ipv6 unicast-routing
R1(config)# interface gigabitethernet0/0
R1(config-if)# ipv6 address 2001:DB8:E:1::1/64
R1(config-if)# no shutdown
R1(config-if)# exit
R1(config)# interface gigabitethernet0/1
R1(config-if)# ipv6 address 2001:DB8:E:2::1/64
R1(config-if)# no shutdown

R1(config)# ipv6 access-list IPV6-FILTER
R1(config-ipv6-acl)# permit icmp 2001:DB8:E:1::/64 any
R1(config-ipv6-acl)# permit tcp 2001:DB8:E:1::/64 any eq 443
R1(config-ipv6-acl)# deny ipv6 any any

-- Unlike IPv4 ACLs, no separate wildcard mask
-- is needed -- IPv6 ACLs use prefix-length
-- notation directly, matching the address
-- syntax used throughout IPv6 configuration

R1(config)# interface gigabitethernet0/0
R1(config-if)# ipv6 traffic-filter IPV6-FILTER in

-- Note the distinct command name: ipv6
-- traffic-filter, rather than IPv4's
-- ip access-group

Internal-PC> ping 2001:DB8:E:2::50

!!!!!
Success rate is 100 percent (5/5)

Internal-PC> curl https://[2001:DB8:E:2::50]

-- Successful HTTPS connection

Internal-PC> curl http://[2001:DB8:E:2::50]

-- Connection times out, blocked by the
-- implicit deny at the end of the ACL,
-- since port 80 was never explicitly permitted

R1# show ipv6 access-list IPV6-FILTER

IPv6 access list IPV6-FILTER
    permit icmp 2001:DB8:E:1::/64 any sequence 10
    permit tcp 2001:DB8:E:1::/64 any eq 443 sequence 20
    deny ipv6 any any sequence 30

Key Takeaway

The IPv6 ACL command structure mirrors extended IPv4 ACLs closely — permit/deny, protocol, source, destination, port — but is applied with ipv6 traffic-filter instead of ip access-group, and every IPv6 ACL is inherently named rather than optionally named as with IPv4, discussed earlier in this series regarding named ACLs.

Written & researched by Dr. Shahin Siami

Related Articles

Hands-On Lab: Configuring UDLD

This hands-on lab configures UDLD in aggressive mode on a fiber link between two switches, simulating a unidirectional fiber failure and verifying UDLD detects the mismatch and shuts down the affected port before a Layer 2 loop can form.

Continue

Hands-On Lab: Configuring Loop Guard

This hands-on lab configures Loop Guard on a switch's non-designated ports to prevent a unidirectional link failure from causing a Layer 2 loop, simulating a one-way BPDU loss and verifying the affected port enters a loop-inconsistent blocking state rather than incorrectly transitioning to forwarding.

Continue

Hands-On Lab: Configuring BPDU Guard and BPDU Filter

This hands-on lab configures BPDU Guard globally for PortFast-enabled ports and demonstrates the distinct, riskier behavior of BPDU Filter, comparing how each responds when a switch is connected to an access port that should only ever see end-user devices.

Continue

Hands-On Lab: Configuring Root Guard

This hands-on lab configures Root Guard on switch ports facing access-layer switches to prevent an unauthorized or misconfigured switch from becoming the Spanning Tree root, verifying the port enters a root-inconsistent state when a superior BPDU is received.

Continue

Hands-On Lab: Comprehensive Troubleshooting Challenge

This hands-on lab presents a multi-layer connectivity failure across VLANs, trunking, routing, and NAT simultaneously, requiring systematic bottom-up troubleshooting to identify and correct three independent faults before full connectivity is restored.

Continue

Hands-On Lab: Configuring Enhanced Object Tracking with HSRP

This hands-on lab configures IP SLA-based object tracking on an HSRP-enabled router, automatically lowering its priority when its WAN uplink fails, forcing failover to the standby router without requiring a full interface shutdown.

Continue
Previous ArticleNext Article