Cisco Catalyst 2960-XR User Manual

The switch does not support VLAN ACLs (VLAN maps) for IPv6 traffic.
You can apply both IPv4 and IPv6 ACLs to an interface. As with IPv4 ACLs, IPv6 port ACLs take precedence
over router ACLs.
Switch Stacks and IPv6 ACLs
The active switch supports IPv6 ACLs in hardware and distributes the IPv6 ACLs to the stack members.
If a standby switch takes over as the active switch, it distributes the ACL configuration to all stack members.
The member switches sync up the configuration distributed by the new active switch and flush out entries
that are not required.
When an ACL is modified, attached to, or detached from an interface, the active switch distributes the change
to all stack members.
Interactions with Other Features and Switches
•
If an IPv6 router ACL is configured to deny a packet, the packet is not routed. A copy of the packet is
sent to the Internet Control Message Protocol (ICMP) queue to generate an ICMP unreachable message
for the frame.
•
If a bridged frame is to be dropped due to a port ACL, the frame is not bridged.
•
You can create both IPv4 and IPv6 ACLs on a switch or switch stack, and you can apply both IPv4 and
IPv6 ACLs to the same interface. Each ACL must have a unique name; an error message appears if you
try to use a name that is already configured.
You use different commands to create IPv4 and IPv6 ACLs and to attach IPv4 or IPv6 ACLs to the same
Layer 2 or Layer 3 interface. If you use the wrong command to attach an ACL (for example, an IPv4
command to attach an IPv6 ACL), you receive an error message.
•
You cannot use MAC ACLs to filter IPv6 frames. MAC ACLs can only filter non-IP frames.
•
If the hardware memory is full, packets are dropped on the interface and an unload error message is
logged.
Restrictions for IPv6 ACLs
With IPv4, you can configure standard and extended numbered IP ACLs, named IP ACLs, and MAC ACLs.
IPv6 supports only named ACLs.
The switch supports most Cisco IOS-supported IPv6 ACLs with some exceptions:
•
The switch does not support matching on these keywords: flowlabel, routing header, and
undetermined-transport.
•
The switch does not support reflexive ACLs (the reflect keyword).
•
This release supports only port ACLs and router ACLs for IPv6; it does not support VLAN ACLs (VLAN
maps).
•
The switch does not apply MAC-based ACLs on IPv6 frames.
Catalyst 2960-XR Switch Security Configuration Guide, Cisco IOS Release 15.0(2)EX1
156 OL-29434-01
Configuring IPv6 ACLs
Switch Stacks and IPv6 ACLs

Cisco Catalyst 2960-XR Specifications

General

Brand	Cisco
Model	Catalyst 2960-XR
Category	Switch
Language	English