- [Narrator] Let's now take a look
at IP version six traffic filters.
With IP version six
the standard ACL functionality is essentially the same
as we see in IP version four.
These ACLs determine which traffic is blocked
and what gets forwarded,
which gives us filtering based on both source
and destination addresses,
with IP version six ACLs.
This allows us to support traffic filtering
and this filtering can be based on
optional upper layer protocol type information
and option hitters.
So this gives us more level of control.
So again, many
of the same rules apply here as with IP version four ACLs.
These are processed from the top down,
so you want your more specific entries
at the top followed by the more general entries.
We have immediate execution when a match is found.
Meaning that if traffic matches multiple ACL entries,
only the first entry will be processed.
And we have an implicit deny any at the bottom of the ACL.
So if there is no matching entry for the traffic
it's going to be automatically denied based on that rule.
One additional fact to be aware of,
is that there is an implicit permit icmp any nd
with IP version six ACLs,
nd meaning Neighbor discovery messages.
So if there are Neighbor Solicitation messages
or Neighbor Advertisement messages,
the default action is to permit these
with an IP version six ACL.
We call those NS and NA messages for short.
Implicitly allowing these types of messages,
will allow our devices to determine
the Mac addresses associated with an IP version six address.
So this operates
in the same way that ARP operates within IP version four.
So those are very important to allow.
Here in our live interface, let's run the command show
IP version six, access hyphen list
and notice the IP version six qualifier that I used
in this command.
Do you want to say IP version six when you are showing those
and when you're creating those.
So this gives us a look at a very basic
IP version six ACL that I already have in place.
We can see the name of that, which is Corporate.
You might notice right off the bat
that there are no wildcard masks here.
Instead, we have a specified prefix that does the same thing
with an IP version six
as wildcard masks do, within IP version four.
So for example,
we see the second entry here,
that has a prefix of slash 128,
meaning that all 128 bits in the IP version six address,
must match.
This is indicated in iOS with just the double colon.
And there's no actual prefix identifier here,
even though when I can figure this,
I entered slash 128.
That is how this is listed within iOS.
The equivalent of this would be an all zeros wildcard mask.
If you're thinking about that in terms of IP version four
and the first entry,
is my more specific entry,
that has a slash 64 prefix
meaning that, the first 64 bits must match
and the last 64 bits do not have to match.
Now likewise,
if we had a slash zero prefix, that would mean that no bits
in the address would have to match, and that will be similar
to a, all 255 IP version four wildcard mask.
So first off when you're troubleshooting
IP version six traffic filters,
make sure you have the correct prefix configured.
Now in order to perform traffic filtering,
we need to apply an IP version six ACL
to a specified interface.
The same as we do with IP version four ACL.
So actually let's go ahead and do that.
Let's go under global configuration mode
we'll go under interface gig zero slash zero
and I'll say IP version six traffic hyphen filter.
And we can follow that with the name
of our IP version six ACL, which is of course Corporate.
And we want to specify the direction.
I'll just make that inbound with the end keyword.
I'll break out of that.
And I'll say
show IP version six interface gig zero slash zero.
And that's going to give us the same type
of output as we looked at with IP version four
again, notice the IP version six qualifier we've used.
And right here
we can see that it tells us our inbound access list,
which is of course the Corporate access list that we attach.
So that's another place that you want
to look when you're troubleshooting.
You want to make sure
that you're using both the correct interface number
that you're using the correct list name and
that you're choosing the correct
direction when you're applying that to your interface.
One more thing I'll mention here when troubleshooting,
if you're having issues with Neighbor discovery
in IP version six, make sure you haven't issued
the command deny IP version six any, any log,
and let me actually type that out.
So it looks like this,
deny IPv six any, any log,
that is a fairly common command to use
at the end of an IP version four ACL.
Because what that will do is that
will create SIS log entries
for any traffic that is denied by the ACL.
But if you use this within IP version six,
that's going to override the implicit permit statement
that we talked about earlier,
that implicit permit icmp any nd for Neighbor discovery.
So this will actually break your Neighbor discovery.
Actually let me go back into our ACL
and we'll take a look at how we can adjust that
so that it still works.
We'll say IP version six, access hyphen list.
The name of that list was corporate.
And let's say that we do enter the command
deny IP version six, any, any log.
If we do this again
that's going to block our neighbor discovery process.
So if we use that,
if we do want to enable this type of logging
we want to enable two additional
permit statements to override that.
And those are,
permit icmp any any,
and if we look at contextual help,
what we're looking for here is we have the option,
we have two options actually that I'll point out.
I'll highlight both of those.
We have Neighbor discovery, Neighbor advertisements
and we have Neighbor discovery, Neighbor solicitations.
So we do want to permit both of those specifically.
Let me break out of this help command.
And I'll start with nd-na four Neighbor advertisements,
I'll arrow up and I'll change that to nd-ns
for Neighbor solicitations.
So again, if you do enable logging
in this manner, you want to permit both of these types
of Neighbor discovery messages to be allowed through.
So that's a look at some common troubleshooting steps,
for IP version six traffic filters.