Lab Objective
Configure a named IPv6 ACL permitting only ICMPv6 and HTTPS traffic from a specific internal subnet, apply it to an interface, and verify both allowed and blocked IPv6 traffic behave correctly.
Lab Purpose
IPv6 ACLs follow the same conceptual logic as the IPv4 ACLs covered earlier in this series, but use IPv6-specific syntax and are always named rather than numbered — understanding this parallel structure lets an engineer apply existing ACL knowledge directly to dual-stack environments.
Lab Topology
R1
Gi0/0: 2001:DB8:E:1::1/64 (internal LAN)
Gi0/1: 2001:DB8:E:2::1/64 (toward destination
server subnet)Task 1: Configure Basic IPv6 Addressing
Enable IPv6 routing and configure both interfaces as shown.
Task 2: Create a Named IPv6 ACL
Create an IPv6 ACL named IPV6-FILTER permitting ICMPv6 and HTTPS (port 443) from the internal LAN prefix to any destination, denying everything else.
Task 3: Apply the ACL to the Interface
Apply IPV6-FILTER inbound on Gi0/0.
Task 4: Verify Permitted Traffic
Confirm an internal host can successfully ping (ICMPv6) and reach an HTTPS server on the destination subnet.
Task 5: Verify Denied Traffic
Confirm the same internal host cannot reach an HTTP (port 80) server on the destination subnet.
Solution and Verification
R1(config)# ipv6 unicast-routing
R1(config)# interface gigabitethernet0/0
R1(config-if)# ipv6 address 2001:DB8:E:1::1/64
R1(config-if)# no shutdown
R1(config-if)# exit
R1(config)# interface gigabitethernet0/1
R1(config-if)# ipv6 address 2001:DB8:E:2::1/64
R1(config-if)# no shutdownR1(config)# ipv6 access-list IPV6-FILTER
R1(config-ipv6-acl)# permit icmp 2001:DB8:E:1::/64 any
R1(config-ipv6-acl)# permit tcp 2001:DB8:E:1::/64 any eq 443
R1(config-ipv6-acl)# deny ipv6 any any
-- Unlike IPv4 ACLs, no separate wildcard mask
-- is needed -- IPv6 ACLs use prefix-length
-- notation directly, matching the address
-- syntax used throughout IPv6 configurationR1(config)# interface gigabitethernet0/0
R1(config-if)# ipv6 traffic-filter IPV6-FILTER in
-- Note the distinct command name: ipv6
-- traffic-filter, rather than IPv4's
-- ip access-groupInternal-PC> ping 2001:DB8:E:2::50
!!!!!
Success rate is 100 percent (5/5)
Internal-PC> curl https://[2001:DB8:E:2::50]
-- Successful HTTPS connectionInternal-PC> curl http://[2001:DB8:E:2::50]
-- Connection times out, blocked by the
-- implicit deny at the end of the ACL,
-- since port 80 was never explicitly permittedR1# show ipv6 access-list IPV6-FILTER
IPv6 access list IPV6-FILTER
permit icmp 2001:DB8:E:1::/64 any sequence 10
permit tcp 2001:DB8:E:1::/64 any eq 443 sequence 20
deny ipv6 any any sequence 30Key Takeaway
The IPv6 ACL command structure mirrors extended IPv4 ACLs closely — permit/deny, protocol, source, destination, port — but is applied with ipv6 traffic-filter instead of ip access-group, and every IPv6 ACL is inherently named rather than optionally named as with IPv4, discussed earlier in this series regarding named ACLs.