Brocade FastIron Ethernet Switch Security Configuration Guide - Manual (Page 158)

• permit icmp any any nd-na - Allows ICMP neighbor discovery acknowledgements.
• permit icmp any any nd-ns - Allows ICMP neighbor discovery solicitations.
• deny ipv6 any any - Denies IPv6 traffic. You must enter a permit ipv6 any any as the last
statement in the access-list if you want to permit IPv6 traffic that were not denied by the previous
statements.
NOTE
If an IPv6 ACL has the implicit deny condition, make sure it also permits the IPv6 link-local address, in
addition to the global unicast address. Otherwise, routing protocols such as OSPF will not work. To
view the link-local address, use the show ipv6 interface command.
The conditions are applied in the order shown above, with deny ipv6 any any as the last condition
applied.
For example, if you want to deny ICMP neighbor discovery acknowledgement, then permit any
remaining IPv6 traffic, enter commands such as the following.
device(config)# ipv6 access-list netw
device(config-ipv6-access-list-netw)# permit icmp 2001:DB8:e0bb::/64
2001:DB8::/64
device(config-ipv6-access-list-netw)# deny icmp any any nd-na
device(config-ipv6-access-list-netw)# permit ipv6 any any
The first permit statement permits ICMP traffic from hosts in the 2001:DB8:e0bb::x network to hosts in
the 2001:DB8::x network.
The deny statement denies ICMP neighbor discovery acknowledgement.
The last entry permits all packets that are not explicitly denied by the other entries. Without this entry,
the ACL will deny all incoming IPv6 traffic on the ports to which you assigned the ACL.
Furthermore, if you add the statement deny icmp any any in the access list, then all neighbor
discovery messages will be denied. You must explicitly enter the permit icmp any any nd-na and
permit icmp any any nd-ns statements just before the deny icmp statement if you want the ACLs to
permit neighbor discovery as in the example below.
device(config)#ipv6 access-list netw
device(config-ipv6-access-list-netw)#permit icmp 2001:DB8:e0bb::/64
2001:DB8::/64
device(config-ipv6-access-list-netw)#permit icmp any any nd-na
device(config-ipv6-access-list-netw)#permit icmp any any nd-ns
device(config-ipv6-access-list-netw)#deny icmp any any
device(config-ipv6-access-list-netw)#permit ipv6 any any
Creating an IPv6 ACL
Before an IPv6 ACL can be applied to an interface, it must first be created, and then IPv6 must be
enabled on that interface.
To create an IPv6 ACL, enter commands such as the following:
device(config)# ipv6 access-list fdry
device(config-ipv6-access-list-fdry)# deny tcp host 2001:DB8:e0bb::2 any eq
telnet
device(config-ipv6-access-list-fdry)# permit ipv6 any any
device(config-ipv6-access-list-fdry)# exit
This creates an access list that blocks all Telnet traffic from IPv6 host 2001:DB8:e0bb::2.
Creating an IPv6 ACL
158 FastIron Ethernet Switch Security Configuration Guide
53-1003088-03