In which configuration mode is ipv6 access-list [name] used?

The ipv6 access-list [name] command is entered in Global Config mode on Cisco IOS devices.

ACLGlobal Config

ipv6 access-list [name]

Creates or enters IPv6 access list configuration mode to define a named IPv6 access control list for filtering IPv6 traffic based on source/destination addresses, ports, and protocols.

Definition: ipv6 access-list [name] is a Cisco IOS global config command. Creates or enters IPv6 access list configuration mode to define a named IPv6 access control list for filtering IPv6 traffic based on source/destination addresses, ports, and protocols.

Overview

The `ipv6 access-list [name]` command is used in global configuration mode to create or enter a named IPv6 access control list (ACL) configuration mode. This command is essential for filtering IPv6 traffic based on source and destination addresses, ports, and protocols. IPv6 ACLs function similarly to IPv4 extended ACLs but are specifically designed for IPv6 networks, supporting features like flow labeling and extension headers.

Network engineers reach for this command when they need to implement security policies, restrict traffic between segments, or control routing updates in an IPv6 environment. Unlike IPv4 ACLs, IPv6 ACLs are always named (no numbered ACLs) and require the `ipv6 traffic-filter` command applied to an interface to take effect. The command places the router in IPv6 ACL configuration mode, where permit/deny statements are defined.

It is a critical tool for securing IPv6 deployments, especially as IPv6 adoption grows. The command is available in IOS 12.2(2)T and later, and it is a fundamental skill for CCNA and CCNP candidates. When configuring, remember that IPv6 ACLs have an implicit deny all at the end, and they do not support the `any` keyword for source/destination; instead, use `::/0` or `any` (which is actually supported in later IOS versions).

The command directly modifies the running configuration, and changes take effect immediately when applied to an interface. Privilege level 15 is required to enter global config mode. Understanding this command is vital for troubleshooting IPv6 connectivity issues, as misconfigured ACLs can silently drop traffic.

Syntax·Global Config

ipv6 access-list [name]

When to Use This Command

Restricting inbound IPv6 traffic on a WAN interface to allow only specific services like HTTP and HTTPS from a remote branch.
Permitting OSPFv3 adjacency formation between routers while blocking all other IPv6 traffic on a point-to-point link.
Creating an IPv6 ACL to limit management access (SSH, SNMP) to the router from a specific IPv6 management subnet.
Filtering outbound IPv6 traffic from a guest VLAN to prevent access to internal corporate resources.

Parameters

Parameter	Syntax	Required	Description
name	WORD (1-64 characters)	Required	The name of the IPv6 access list. It must be a unique alphanumeric string. Common mistakes include using spaces or special characters, or reusing a name that already exists (which enters edit mode).

Command Examples

Basic IPv6 ACL to permit SSH from a specific host

ipv6 access-list PERMIT-SSH

This command enters IPv6 ACL configuration mode for the ACL named PERMIT-SSH. No output is displayed; subsequent permit/deny statements define the ACL entries.

IPv6 ACL with multiple entries and applying to interface

ipv6 access-list FILTER-ICMP
 permit icmp any any echo-request
 permit icmp any any echo-reply
 deny icmp any any
 permit ipv6 any any
!
interface GigabitEthernet0/0
 ipv6 traffic-filter FILTER-ICMP in

This sequence creates an ACL named FILTER-ICMP that permits ICMP echo-request and echo-reply (ping), denies all other ICMP, then permits all other IPv6 traffic. The ACL is applied inbound on GigabitEthernet0/0 using the ipv6 traffic-filter command.

Understanding the Output

The ipv6 access-list command itself does not produce output; it enters ACL configuration mode. To view the ACL, use 'show ipv6 access-list [name]'. The output lists each ACE (Access Control Entry) with sequence numbers, permit/deny action, protocol, source/destination addresses (with prefix lengths), and optional port or ICMP type.

Key fields: 'sequence' (order of evaluation), 'permit/deny' (action), 'ipv6 any any' (match all), 'eq' (equals port). Good ACLs have specific entries before general ones. Watch for implicit deny at the end; if no permit matches, traffic is dropped.

Also check for 'log' keyword to see if logging is enabled.

Configuration Scenarios

Restrict IPv6 traffic between two internal VLANs

A company has two IPv6 subnets: 2001:db8:1::/64 (Sales) and 2001:db8:2::/64 (Engineering). They want to allow Engineering to initiate connections to Sales but block all traffic from Sales to Engineering except for ICMPv6.

Topology

R1(Gi0/0.10)---2001:db8:1::/64---Sales
R1(Gi0/0.20)---2001:db8:2::/64---Engineering

Steps

1.Step 1: Enter global configuration mode: configure terminal
2.Step 2: Create the IPv6 ACL: ipv6 access-list ENG-TO-SALES
3.Step 3: Permit Engineering to Sales: permit ipv6 2001:db8:2::/64 2001:db8:1::/64
4.Step 4: Deny Sales to Engineering: deny ipv6 2001:db8:1::/64 2001:db8:2::/64
5.Step 5: Permit ICMPv6 from Sales to Engineering: permit icmp 2001:db8:1::/64 2001:db8:2::/64
6.Step 6: Exit ACL configuration: exit
7.Step 7: Apply ACL to Engineering interface: interface gigabitethernet0/0.20
8.Step 8: Apply as traffic-filter: ipv6 traffic-filter ENG-TO-SALES in
9.Step 9: Exit and save: end, write memory

Configuration

! Full IOS config block
ipv6 access-list ENG-TO-SALES
 permit ipv6 2001:db8:2::/64 2001:db8:1::/64
 deny ipv6 2001:db8:1::/64 2001:db8:2::/64
 permit icmp 2001:db8:1::/64 2001:db8:2::/64
 exit
interface gigabitethernet0/0.20
 ipv6 traffic-filter ENG-TO-SALES in

Verify: Use `show ipv6 access-list ENG-TO-SALES` to verify the ACL entries. Expected output shows the permit/deny statements with hit counts. Use `show ipv6 interface gigabitethernet0/0.20` to confirm the ACL is applied.

Watch out: The order of ACL entries matters. If the deny statement comes before the permit for ICMP, ICMP from Sales to Engineering will be denied. Also, remember to apply the ACL inbound on the Engineering interface to filter traffic coming from Sales.

Block external IPv6 traffic to internal servers except HTTP/HTTPS

A web server at 2001:db8:10::100 hosts a public website. All inbound traffic from the internet (2001:db8:ffff::/32) should be blocked except HTTP (port 80) and HTTPS (port 443).

Topology

Internet---(Gi0/0)R1(Gi0/1)---2001:db8:10::/64---Server

Steps

1.Step 1: Enter global configuration mode: configure terminal
2.Step 2: Create the IPv6 ACL: ipv6 access-list BLOCK-EXTERNAL
3.Step 3: Permit HTTP from internet to server: permit tcp 2001:db8:ffff::/32 host 2001:db8:10::100 eq 80
4.Step 4: Permit HTTPS: permit tcp 2001:db8:ffff::/32 host 2001:db8:10::100 eq 443
5.Step 5: Deny all other IP traffic: deny ipv6 any any
6.Step 6: Exit ACL configuration: exit
7.Step 7: Apply ACL to external interface: interface gigabitethernet0/0
8.Step 8: Apply inbound: ipv6 traffic-filter BLOCK-EXTERNAL in
9.Step 9: Exit and save: end, write memory

Configuration

! Full IOS config block
ipv6 access-list BLOCK-EXTERNAL
 permit tcp 2001:db8:ffff::/32 host 2001:db8:10::100 eq 80
 permit tcp 2001:db8:ffff::/32 host 2001:db8:10::100 eq 443
 deny ipv6 any any
 exit
interface gigabitethernet0/0
 ipv6 traffic-filter BLOCK-EXTERNAL in

Verify: Use `show ipv6 access-list BLOCK-EXTERNAL` to verify entries. Test connectivity from an external host using ping (should fail) and HTTP (should succeed).

Watch out: The implicit deny at the end of the ACL will block all traffic not explicitly permitted. If you forget the deny statement, the implicit deny still applies. Also, ensure the server's IPv6 address is correctly specified with the `host` keyword.

Troubleshooting with This Command

When troubleshooting IPv6 ACLs, the primary command is `show ipv6 access-list [name]`. Healthy output shows each ACL entry with a match count. If the match count is zero for a permit entry, traffic may not be reaching the ACL or the ACL is misconfigured.

Problem indicators include high match counts on deny entries (indicating blocked legitimate traffic) or no matches at all (suggesting the ACL is not applied or traffic is taking a different path). Focus on the sequence numbers and order of entries; a deny entry before a permit will block traffic. Common symptoms include inability to reach a server (check if ACL is blocking the port), asymmetric routing (apply ACL on correct interface and direction), or no effect (verify ACL is applied with `show ipv6 interface`).

Diagnostic flow: 1) Verify ACL is applied to the correct interface and direction using `show ipv6 interface`. 2) Check ACL hit counts with `show ipv6 access-list`. 3) If no hits, use `debug ipv6 packet` (carefully) to see if packets are being dropped. 4) Correlate with `show ipv6 route` to ensure traffic is routed correctly. 5) Use `ping` with extended options to test specific source/destination. For example, `ping ipv6 2001:db8:10::100 source 2001:db8:ffff::1` can test ACL rules. Also, check for implicit deny: if no permit matches, all traffic is denied.

Remember that IPv6 ACLs do not filter locally generated traffic unless applied to the outgoing interface. Correlate with `show logging` for ACL deny messages if logging is enabled.

CCNA Exam Tips

Remember that IPv6 ACLs use 'ipv6 traffic-filter' (not 'ip access-group') to apply to interfaces.

IPv6 ACLs have an implicit deny ipv6 any any at the end; always include a permit statement if you want to allow traffic not explicitly denied.

CCNA exam may test the order of ACEs: the first match wins, so place more specific entries before general ones.

Know that IPv6 ACLs can filter based on upper-layer protocols (TCP, UDP, ICMPv6) and use port numbers with 'eq', 'gt', 'lt', 'range'.

Common Mistakes

Forgetting to apply the ACL to an interface with 'ipv6 traffic-filter' — the ACL is defined but not enforced.

Using 'ip access-group' (IPv4 command) instead of 'ipv6 traffic-filter' for IPv6 ACLs.

Misordering ACEs: placing a broad permit/deny before a specific one, causing the specific rule to never be evaluated.

ipv6 access-list [name] vs ipv6 traffic-filter [name] [in|out]

Both commands are part of IPv6 ACL configuration in Cisco IOS, but they serve different stages: 'ipv6 access-list' defines the ACL rules globally, while 'ipv6 traffic-filter' applies an existing ACL to an interface. They are commonly confused because both involve ACLs and share similar syntax, but operate at different configuration modes and stages of traffic filtering.

Aspect	ipv6 access-list [name]	ipv6 traffic-filter [name] [in\|out]
Scope	Global (defines ACL rules)	Interface (applies ACL to traffic)
Configuration mode	Global configuration mode	Interface configuration mode
Persistence	ACL definition saved in running-config	Application saved in interface config
Precedence	Must exist before being applied	References existing ACL; order of interface application matters
Typical use	Creating permit/deny rules	Activating ACL on interface for filtering

Use ipv6 access-list [name] when you need to define or edit an IPv6 ACL with permit/deny statements based on source/destination addresses, ports, and protocols.

Use ipv6 traffic-filter [name] [in|out] when you need to apply a previously defined IPv6 ACL to a specific interface to filter inbound or outbound traffic.

Platform Notes

In IOS-XE, the command syntax is identical, but output formatting may differ slightly (e.g., `show ipv6 access-list` may display in a more structured format). In NX-OS, the equivalent command is `ipv6 access-list [name]` but with different subcommands: use `permit/deny ipv6` with `src dst` and optional `log`. NX-OS also supports object-groups for ACLs.

For ASA, IPv6 ACLs are configured using `ipv6 access-list [name]` similar to IOS, but the ASA uses `access-group` to apply to interfaces. In IOS-XR, the command is `ipv6 access-list [name]` but with a different configuration mode; XR uses `permit/deny ipv6` and requires a sequence number. Differences between IOS versions: In 12.x, the `any` keyword is not supported; use `::/0` instead.

In 15.x and later, `any` is supported. Also, in older IOS, the `ipv6 traffic-filter` command may not exist; use `ipv6 access-group` instead (deprecated). Always check the specific IOS version documentation.

For CCNA/CCNP, focus on IOS 15.x syntax.

Related Commands

ipv6 traffic-filter [name] [in|out]

Applies an IPv6 ACL to filter inbound or outbound traffic on an interface.

Practice for the CCNA 200-301

Test your knowledge with practice questions covering all CCNA 200-301 exam domains.

Practice CCNA 200-301 Questions