IPv6 的ACL配置及注意點

IPv6ACL規則以下：

1 只能使用命名的ACL

2 ACL序號匹配由小到大

3 默認狀況下，隱含permit icmp any any nd-na 和permit icmp anyany nd-ns 用於鄰居發現協議的鄰居通告和鄰居請求，容許接口發送和接收IPv6鄰居發現包。

3 結尾默認隱含 deny ipv6 any any

4 使用命令ipv6 traffic-filter應用於接口的in or out方向

需求：在R1配置ACL，禁止R1的環回接口訪問R4的環回接口地址；

ACL配置以下，其它配置略：

R1(config)#ipv6 access-list Mao

R1(config-ipv6-acl)#deny 2011::1/1282044::4/128

R1(config-ipv6-acl)#permit any any

R1(config)#int fa0/0

R1(config-if)#ipv6 traffic-filter Mao out

R1#show ipv6 access-list

IPv6 access list Mao

   deny ipv6 host 2011::1 host 2044::4 sequence 10

permit ipv6 anyany sequence 20

R1#ping 2044::4 source 2011::1

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 2044::4,timeout is 2 seconds:

Packet sent with a source address of2011::1

!!!!!

Success rate is 100 percent (5/5),round-trip min/avg/max = 24/36/52 ms

爲何會ping通呢？是由於命令ipv6 traffic-filter的做用是過濾路由器轉發的流量，但不過濾源自本路由器的流量；

如今將ACL進行修改以下，拒絕從R4環回接口發回來的數據包，並將ACL應用至fa0/0的入接口方向上；

R1(config)#ipv6access-list Mao

R1(config-ipv6-acl)#no deny ipv6 host 2011::1 host 2044::4

R1(config-ipv6-acl)#deny ipv6 2044::4/128 2011::1/128

R1(config-ipv6-acl)#permit any any

R1(config-if)#no ipv6 traffic-filter Mao out

R1(config-if)#ipv6 traffic-filter Mao in

R1#ping2044::4 source 2011::1

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 2044::4,timeout is 2 seconds:

Packet sent with a source address of2011::1

.....

Success rate is 0 percent (0/5)

R1#show access-lists          

IPv6 access list Mao

   deny ipv6 host 2044::4 host 2011::1 (5 matches) sequence 30 //匹配了5個數據包

permit ipv6 anyany (4 matches) sequence 40

總結：命令ipv6traffic-filter不過濾源自本路由器的流量，所以在配置IPv6 ACL時須要注意流量的起源是否來至本路由器。

 

以上例子也能夠在R3上配置，以下：

R3(config)#ipv6access-list Mao

R3(config-ipv6-acl)#deny ipv6 2011::1/128 2044::4/128

R3(config-ipv6-acl)#permit any any

R3(config)#int fa0/1

R3(config-if)#ipv6 traffic-filter Mao out

R1#ping 2044::4 source 2011::1

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 2044::4,timeout is 2 seconds:

Packet sent with a source address of2011::1

SSSSS

Success rate is 0 percent (0/5)

不通，在R1和R3之間抓包可知，以下圖：

ICMPv6的類型爲1，表示目標不可達，代碼字段爲5，源地址被入站/出站策略所阻止。