Configuring an IPv6 advanced ACL

1. Enter system view.

system-view

N/A

2. Create an IPv6 advanced ACL and enter its view.

acl ipv6 advanced { acl-number | name acl-name } [ match-order { auto | config } ]

acl ipv6 number acl-number [ match-order { auto | config } ]

By default, no ACLs exist.

The value range for a numbered IPv6 advanced ACL is 3000 to 3999.

Use the acl ipv6 number acl-number or acl ipv6 advanced acl-number command to create a numbered IPv6 advanced ACL.

Use the acl ipv6 number acl-number or acl ipv6 advanced acl-number command to enter the view of a numbered IPv6 advanced ACL.

Use the acl ipv6 advanced name acl-name command to enter the view of a named IPv6 advanced ACL.

3. (Optional.) Configure a description for the IPv6 advanced ACL.

description text

By default, an IPv6 advanced ACL does not have a description.

4. (Optional.) Set the rule numbering step.

step step-value [ start start-value ]

By default, the rule numbering step is 5 and the start rule ID is 0.

5. Create or edit a rule.

rule [ rule-id ] { deny | permit } protocol [ { { ack ack-value | fin fin-value | psh psh-value | rst rst-value | syn syn-value | urg urg-value } * | established } | counting | destination { dest-address dest-prefix | dest-address/dest-prefix | any } | destination-port operator port1 [ port2 ] | dscp dscp | flow-label flow-label-value | fragment | icmp6-type { icmp6-type icmp6-code | icmp6-message } | logging | routing [ type routing-type ] | hop-by-hop [ type hop-type ] | source { source-address source-prefix | source-address/source-prefix | any } | source-port | time-range time-range-name ] *

By default, no IPv6 advanced ACL rules exist.

The logging keyword takes effect only when the module (for example, packet filtering) that uses the ACL supports logging.

If an ACL is for QoS traffic classification or packet filtering:

• Do not specify the fragment keyword.

• Do not specify neq for the operator argument.

• Do not specify the routing, hop-by-hop, or flow-label keyword if the ACL is for outbound application.

• Do not specify ipv6-ah for the protocol argument or set its value to 0, 43, 44, 51, or 60 if the ACL is for outbound application..

6. (Optional.) Add or edit a rule comment.

rule rule-id comment text

By default, no rule comment is configured.