HP 6200YL - Manual (Page 204)

IPv6 Access Control Lists (ACLs)
Planning an ACL Application
Depending on the source and/or destination of a given IPv6 traffic type, you
must also determine the ACL application(s) (VACL or static port ACL) needed
to filter the traffic on the applicable switch interfaces. Answering the
following questions can help you to design and properly position ACLs for
optimum network usage.
■ What are the logical points for minimizing unwanted IPv6 traffic, and
what ACL application(s) should be used? In many cases it makes
sense to prevent unwanted IPv6 traffic from reaching the core of your
network by configuring ACLs to drop unwanted IPv6 traffic at or close
to the edge of the network. (The earlier in the network path you can
deny unwanted traffic, the greater the benefit for network perfor­
mance.)
■ From where is the traffic coming? The source and destination of IPv6
traffic you want to filter determines the ACL application to use (VACL,
static port ACL, and RADIUS-assigned ACL).
■ What IPv6 traffic should you explicitly deny? Depending on your
network size and the access requirements of individual hosts, this can
involve creating a large number of ACEs in a given ACL (or a large
number of ACLs), which increases the complexity of your solution.
■ What IPv6 traffic can you implicitly deny by taking advantage of the
implicit
deny ipv6 any any to deny IPv6 traffic that you have not
explicitly permitted? This can reduce the number of entries needed
in an ACL.
■ What IPv6 traffic should you permit? In some cases you will need to
explicitly identify permitted IPv6 traffic. In other cases, depending on
your policies, you can insert an ACE with “permit any” forwarding at
the end of an ACL. This means that IPv6 traffic not specifically
matched by earlier entries in the list will be permitted.
Security
ACLs can enhance security by blocking IPv6 traffic carrying an unauthorized
source IPv6 address (SA). This can include:
■ blocking access from specific devices or interfaces (port or VLAN)
■ blocking access to or from subnets in your network
■ blocking access to or from the internet
8-28