How an ACE uses a prefix to screen packets for SA and DA matches

For an IPv6 ACL, a match with a packet occurs when both the protocol and the SA/DA configured in a given ACE within the ACL are a match with the same criteria in a packet being filtered by the ACL.

In IPv6 ACEs, prefixes define how many leading bits in the SA and DA to use for determining a match. That is, the switch uses IPv6 prefixes in CIDR format to specify how many leading bits in a packet's SA and DA must be an exact match with the same bits in an ACE. The bits to the right of the prefix are "wildcards" and are not used to determine a match.

Prefix

Range of applicable addresses

Examples

/0

Any IPv6 host

::/0

/ 1-/127

All IPv6 hosts within the range defined by the number of bits in the prefix

2001:db8::/482001:db8::/64

/128

One IPv6 host

2001:db8::218:71ff:fec4:2f00/128

SA/DA prefix lengths

The following ACE applies to Telnet packets from a source address where the leading bits are set to 2001:db8:10:1 and any destination address where the leading bits are set to 2001:db8:10:1:218:71ff:fec.

permit tcp 2001:db8:10:1::/64 eq 23 2001:db8:10:1:218:71ff:fec4::/112
::/64

Prefix Defining the Mask for the Leading Bits in the Source Address

::/112

Prefix Defining the Mask for the Leading Bits in the Destination Address

Thus, in the above example, if an IPv6 Telnet packet has an SA match with the ACE's leftmost 64 bits and a DA match with the ACE's leftmost 112 bits, there is a match and the packet is permitted. In this case, the source and destination addresses allowed are:

Address Prefix Range of unicast addresses

Source (SA)

2001:db8:10:1

prefix

::0 toprefix :FFFF:FFFF:FFFF:FFFF

Destination (DA)

2001:db8:10:1:218:71ff:fec4

prefix

:0toprefix :FFFF

To summarize, when the switch compares an IPv6 packet to an ACE in an ACL, it uses the subnet prefixes configured with the SA and DA in the ACE to determine how many leftmost, contiguous bits in the ACE's SA and DA must be matched by the same bits in the SA and DA carried by the packet. Thus, the subnet prefixes specified with the SA and DA in an ACE determine the ranges of source and destination addresses acceptable for a match between the ACE and a packet being filtered.