Brocade BigIron RX Series Configuration Guide - Manual (Page 1367)

BigIron RX Series Configuration Guide 1289
53-1002484-04
Configuring an IPv6 ACL
48
Here is another example of commands for configuring an ACL and applying it to an interface.
The first condition permits ICMP traffic from hosts in the 2000:2383:e0bb::x network to hosts in
the 2001:3782::x network.
The second condition denies all IPv6 traffic from host 2000:2383:e0ac::2 to host
2000:2383:e0aa:0::24.
The third condition denies all UDP traffic.
The fourth condition permits all packets that are not explicitly denied by the other entries. Without
this entry, the ACL would deny all incoming IPv6 traffic on the ports to which you assigned the ACL.
The following commands apply the ACL "netw" to the incoming traffic on port 1/2 and to the
incoming traffic on port 4/3.
BigIron RX(config)# interface ethernet 1/2
BigIron RX(config-if-1/2)# ipv6 traffic-filter netw in
BigIron RX(config-if-1/2)# exit
BigIron RX(config)# interface ethernet 4/3
BigIron RX(config-if-4/3)# ipv6 traffic-filter netw in
BigIron RX(config-if-4/3)# exit
BigIron RX(config)# write memory
Here is another example of an ACL.
BigIron RX(config)# ipv6 access-list rtr
BigIron RX(config-ipv6-access-list rtr)# deny tcp 2001:1570:21::/24
2001:1570:22::/24
BigIron RX(config-ipv6-access-list rtr)# deny udp any range 5 6 2001:1570:22::/24
BigIron RX(config-ipv6-access-list rtr)# permit ipv6 any any
BigIron RX(config-ipv6-access-list-rtr)# exit
BigIron RX(config)# interface ethernet 2/1
BigIron RX(config-if-2/1)# ipv6 traffic-filter rtr in
BigIron RX(config-if-2/1)# exit
BigIron RX(config)# write memory
The first condition in this ACL denies TCP traffic from the 2001:1570:21::x network to the
2001:1570:22::x network.
The next condition denies UDP packets from any source with source UDP port in ranges 5 to 6 and
whose destination is to the 2001:1570:22::/24 network.
BigIron RX(config)# ipv6 access-list fdry
BigIron RX(config-ipv6-access-list-fdry)# deny tcp host 2000:2382:e0bb::2 any eq
telnet
BigIron RX(config-ipv6-access-list-fdry)# permit ipv6 any any
BigIron RX(config-ipv6-access-list-fdry)# exit
BigIron RX(config)# interface ethernet 1/1
BigIron RX(config-if-1/1)# ipv6 traffic-filter fdry in
BigIron RX(config-if-1/1)# exit
BigIron RX(config)# write memory
BigIron RX(config)# ipv6 access-list netw
BigIron RX(config-ipv6-access-list-netw)# permit icmp 2000:2383:e0bb::/64
2001:3782::/64
BigIron RX(config-ipv6-access-list-netw)# deny ipv6 host 2000:2383:e0ac::2 host
2000:2383:e0aa:0::24
BigIron RX(config-ipv6-access-list-netw)# deny udp any any
BigIron RX(config-ipv6-access-list-netw)# permit ipv6 any any