Cisco Catalyst 3560-X Command Reference Manual page 173
Hide thumbs
Also See for Catalyst 3560-X:
- Software configuration manual (1538 pages) ,
- Command reference manual (1244 pages) ,
- Manual (276 pages)
Table of Contents
Advertisement
Chapter 2
Catalyst 3750-X and 3560-X Switch Cisco IOS Commands
Usage Guidelines
Note
OL-21522-02
Downloaded from
www.Manualslib.com
The deny (IPv6 access-list configuration mode) command is similar to the deny (IPv4 access-list
configuration mode) command, but it is IPv6-specific.
Use the deny (IPv6) command after the
mode and to define the conditions under which a packet passes the access list.
Specifying IPv6 for the protocol argument matches against the IPv6 header of the packet.
By default, the first statement in an access list is number 10, and the subsequent statements are numbered
in increments of 10.
You can add permit, deny, or remark statements to an existing access list without re-entering the entire
list. To add a new statement anywhere other than at the end of the list, create a new statement with an
appropriate entry number between two existing entry numbers to show where it belongs.
Every IPv6 ACL has implicit permit icmp any any nd-na, permit icmp any any nd-ns, and deny ipv6
any any statements as its last match conditions. The two permit conditions allow ICMPv6 neighbor
discovery. To disallow ICMPv6 neighbor discovery and to deny icmp any any nd-na or icmp any any
nd-ns, there must be an explicit deny entry in the ACL. For the three implicit statements to take effect,
an IPv6 ACL must contain at least one entry.
The IPv6 neighbor discovery process uses the IPv6 network layer service. Therefore, by default, IPv6
ACLs implicitly allow IPv6 neighbor discovery packets to be sent and received on an interface. In IPv4,
the Address Resolution Protocol (ARP), which is equivalent to the IPv6 neighbor discovery process, uses
a separate data-link layer protocol. Therefore, by default, IPv4 ACLs implicitly allow ARP packets to
be sent and received on an interface.
Both the source-ipv6-prefix/prefix-length and destination-ipv6-prefix/prefix-length arguments are used
for traffic filtering. (The source prefix filters traffic based upon the traffic source; the destination prefix
filters traffic based upon the traffic destination.)
The switch supports IPv6 address matching for a full range of prefix-lengths.
The fragments keyword is an option only if the protocol is ipv6 and the operator [port-number]
arguments are not specified.
This is a list of ICMP message names:
beyond-scope
echo-reply
header
mld-query
mld-report
nd-ns
no-admin
packet-too-big
parameter-problem
reassembly-timeout
renum-result
router-advertisement
manuals search engine
ipv6 access-list
command to enter IPv6 access list configuration
destination-unreachable
echo-request
hop-limit
mld-reduction
nd-na
next-header
no-route
parameter-option
port-unreachable
renum-command
renum-seq-number
router-renumbering
Catalyst 3750-X and 3560-X Switch Command Reference
deny (IPv6 access-list configuration)
2-141
Advertisement
Table of Contents
