Configuring ACEs in an ACL

Configuring ACEs is done after using the ipv6 access-list <ascii–str> command to enter the IPv6 ACL (ipv6-acl) context of an ACL.

Syntax:

<deny|permit> <ipv6|ipv6-protocol|ipv6-protocol-nbr>

<any|host <SA>|SA/prefix–length> <any|host <DA>|DA/prefix–length> [dscp <tos-bits|precedence] [log]

Appends an ACE to the end of the list of ACEs in the current ACL. In the default configuration, ACEs are automatically assigned consecutive sequence numbers in increments of 10 and can be renumbered using resequence, Resequencing the ACEs in an IPv6 ACL.

<deny|permit>

These keywords are used in the IPv6 (ipv6-acl) context to specify whether the ACE denies or permits a packet matching the criteria in the ACE, as described below.

<ipv6|ipv6-protocol|ipv6-protocol-nbr>

ipv6 - Any IPv6 packet.

ipv6-protocol-nbr -The protocol number of an IPv6 packet type, such as “8” for Exterior Gateway Protocol or 121 for Simple Message Protocol. (Range: 0–255)

(For a listing of IPv6 protocol numbers and their corresponding protocol names, refer to the IANA protocol number assignments at www.iana.com.)

<any|host <SA>|SA/<prefix-length>

This is the first instance of IPv6 addressing in an ACE. It follows the protocol specifier and defines the source IPv6 address (SA) a packet must carry for a match with the ACE.

any -Allows IPv6 packets from any IPv6 SA.

host <SA> - Specifies only packets having a single address as the SA. Use this criterion when you want to match only the IPv6 packets from a single SA.

SA prefix–length - Specifies packets received from one or more contiguous subnets or contiguous addresses within a single subnet. The prefix length is in CIDR format and defines the number of leftmost bits to use in determining a match. (See Using CIDR notation to enter the IPv6 ACL prefix length.) In a given ACE, the SA prefix length defines how many leftmost bits in a packet’s SA must exactly match the SA configured in the ACE.

<any|host <DA>|DA/prefix-length>

This is the second instance of addressing in an IPv6 ACE. It follows the first (SA) instance, described earlier in this section, and defines the destination IPv6 address (DA) that a packet must carry to have a match with the ACE.

any -Allows IPv6 packets to any IPv6 DA.

host <DA> - Specifies only packets having DA as the destination address. Use this criterion when you want to match only the IPv6 packets for a single DA.

DA/prefix–length - Specifies packets intended for one or more contiguous subnets or contiguous addresses within a single subnet. The prefix length is in CIDR format and defines the number of leftmost bits to use in determining a match. (See Using CIDR notation to enter the IPv6 ACL prefix length.) In a given ACE, the DA prefix length defines how many leftmost bits in a packet’s DA must exactly match the DA configured in the ACE.

[dscp <codepoint|precedence]

This option follows the DA to include a DSCP codepoint or precedence as a matching criteria.

codepoint : Supports these codepoint selection options:

0-63: Select a specific DSCP codepoint by entering its decimal equivalent.

default: Matches with the 000000 (default) DSCP.

ef: Expedited forwarding (EF; 000000) DSCP match.

precedence: Supports selection of a precedence setting in the DSCP.

[dscp <codepoint|precedence] [log]

This option can be used after the DA to generate an Event Log message if:

• The action is deny. (Not applicable to permit actions.)

• There is a match.

• ACL logging is enabled. (See Enabling ACL logging on the switch.)

For a given ACE, if log is used, it must be the last keyword entered.