ipv6 traffic-filter [name] [in|out]
Applies an IPv6 ACL to filter inbound or outbound traffic on an interface.
Definition: ipv6 traffic-filter [name] [in|out] is a Cisco IOS interface config command. Applies an IPv6 ACL to filter inbound or outbound traffic on an interface.
Overview
The `ipv6 traffic-filter` command is a fundamental tool for applying IPv6 Access Control Lists (ACLs) to a router interface, enabling or denying traffic based on source/destination addresses, ports, protocols, or other Layer 3/4 criteria. In IPv6 networks, ACLs are critical for security policy enforcement, traffic segmentation, and preventing unauthorized access. Unlike IPv4, where the `access-group` command is used, IPv6 requires `ipv6 traffic-filter` because IPv6 ACLs are defined separately and have distinct syntax (e.g., using `ipv6 access-list`).
This command is typically deployed at network borders, between security zones, or on user-facing interfaces to filter inbound or outbound traffic. It fits into the broader workflow of designing a security policy, creating the ACL, applying it to the interface, and then verifying with `show ipv6 interface` or `show access-list`. A key IOS behavior is that the ACL must exist before applying it; otherwise, the command is rejected.
Also, the ACL is processed in order, and an implicit deny-all exists at the end. The command does not require special privilege levels beyond enable mode, and it immediately affects the running configuration. Understanding this command is essential for CCNA/CCNP candidates as it directly impacts network security and traffic flow in IPv6 environments.
ipv6 traffic-filter [name] [in|out]When to Use This Command
- Restrict IPv6 traffic from a specific subnet entering an interface
- Allow only certain IPv6 services (e.g., HTTP, SSH) outbound on a WAN interface
- Block IPv6 ICMPv6 messages from untrusted sources
- Implement IPv6 access control for guest network segments
Parameters
| Parameter | Syntax | Description |
|---|---|---|
| name | WORD (ACL name) | The name of the IPv6 access list to apply. This must match an existing IPv6 ACL configured with `ipv6 access-list` command. Common mistake: using an IPv4 ACL name or misspelling the name, which causes the command to fail. |
| in|out | in | out | Specifies the direction of traffic to filter. 'in' filters traffic entering the interface; 'out' filters traffic leaving the interface. A common mistake is applying the ACL in the wrong direction, leading to unintended filtering behavior. |
Command Examples
Apply IPv6 ACL inbound on GigabitEthernet0/1
ipv6 traffic-filter BLOCK_TELNET inNo output is generated upon successful application. Use 'show ipv6 interface GigabitEthernet0/1' to verify the ACL is applied.
Apply IPv6 ACL outbound on Serial0/0/0
ipv6 traffic-filter ALLOW_HTTP outNo output is generated upon successful application. Use 'show ipv6 interface Serial0/0/0' to verify the ACL is applied.
Understanding the Output
This command does not produce output when executed. To verify the ACL is applied, use 'show ipv6 interface [interface]'. The output will include a line like 'Inbound IPv6 ACL: [acl-name]' or 'Outbound IPv6 ACL: [acl-name]'.
If no ACL is applied, it will show 'Inbound IPv6 ACL: not set' or 'Outbound IPv6 ACL: not set'. Ensure the ACL name matches exactly and the direction is correct.
Configuration Scenarios
Restrict inbound SSH access to a router from a specific IPv6 subnet
A network administrator wants to allow SSH management from the 2001:DB8:1::/48 subnet only, blocking all other SSH attempts to the router's GigabitEthernet0/0 interface.
Topology
R1(Gi0/0)---2001:DB8:1::/64---(Gi0/0)Management Hosts
R1(Gi0/1)---2001:DB8:2::/64---(Gi0/1)Other NetworksSteps
- 1.Step 1: Enter global configuration mode: configure terminal
- 2.Step 2: Create an IPv6 ACL named 'MANAGEMENT_SSH': ipv6 access-list MANAGEMENT_SSH
- 3.Step 3: Permit SSH from the management subnet: permit tcp 2001:DB8:1::/48 any eq 22
- 4.Step 4: Deny all other SSH (optional, but implicit deny exists): deny tcp any any eq 22
- 5.Step 5: Permit other traffic (if needed): permit ipv6 any any
- 6.Step 6: Exit ACL configuration: exit
- 7.Step 7: Enter interface configuration: interface GigabitEthernet0/0
- 8.Step 8: Apply ACL inbound: ipv6 traffic-filter MANAGEMENT_SSH in
- 9.Step 9: Exit and save: end, write memory
! ipv6 access-list MANAGEMENT_SSH permit tcp 2001:DB8:1::/48 any eq 22 deny tcp any any eq 22 permit ipv6 any any ! interface GigabitEthernet0/0 ipv6 traffic-filter MANAGEMENT_SSH in !
Verify: Use 'show ipv6 interface GigabitEthernet0/0' to verify the ACL is applied. Expected output includes 'Inbound access list: MANAGEMENT_SSH'. Also use 'show access-list MANAGEMENT_SSH' to see hit counts.
Watch out: Forgetting to permit other traffic (like permit ipv6 any any) will cause the implicit deny to block all other traffic, potentially disrupting legitimate services.
Block outbound traffic from a specific IPv6 host to a restricted network
A company wants to prevent a specific host (2001:DB8:2::100) from accessing a sensitive server subnet (2001:DB8:3::/64) while allowing all other outbound traffic from the host's interface.
Topology
R2(Gi0/0)---2001:DB8:2::/64---(Gi0/0)Host 2001:DB8:2::100
R2(Gi0/1)---2001:DB8:3::/64---(Gi0/1)Server SubnetSteps
- 1.Step 1: Enter global configuration mode: configure terminal
- 2.Step 2: Create an IPv6 ACL named 'BLOCK_HOST': ipv6 access-list BLOCK_HOST
- 3.Step 3: Deny traffic from the specific host to the server subnet: deny ipv6 host 2001:DB8:2::100 2001:DB8:3::/64
- 4.Step 4: Permit all other traffic: permit ipv6 any any
- 5.Step 5: Exit ACL configuration: exit
- 6.Step 6: Enter interface configuration: interface GigabitEthernet0/0
- 7.Step 7: Apply ACL outbound (since traffic leaves the interface towards the host): ipv6 traffic-filter BLOCK_HOST out
- 8.Step 8: Exit and save: end, write memory
! ipv6 access-list BLOCK_HOST deny ipv6 host 2001:DB8:2::100 2001:DB8:3::/64 permit ipv6 any any ! interface GigabitEthernet0/0 ipv6 traffic-filter BLOCK_HOST out !
Verify: Use 'show ipv6 interface GigabitEthernet0/0' to confirm the ACL is applied outbound. Use 'show access-list BLOCK_HOST' to see packet matches. Test connectivity from the host to the server subnet; it should be blocked.
Watch out: Applying the ACL outbound on the host-facing interface means it filters traffic leaving the router towards the host. If the host is sending traffic to the server, the ACL must be applied inbound on the interface facing the host, or outbound on the interface facing the server. Misunderstanding direction is a common error.
Troubleshooting with This Command
When troubleshooting IPv6 traffic filtering, the first step is to verify that the ACL is applied correctly on the interface using `show ipv6 interface [interface]`. Look for the line 'Inbound access list' or 'Outbound access list' followed by the ACL name. If the ACL is not listed, the command may have been rejected due to a missing ACL or syntax error.
Next, examine the ACL itself with `show access-list [acl-name]` or `show ipv6 access-list [acl-name]`. Pay attention to the match counters (hits) for each entry. A healthy ACL will show increasing hit counts for permitted traffic and zero or low hits for denied entries.
If a permit entry has zero hits, the traffic might be matching a preceding deny entry, or the traffic is not reaching the interface. Common symptoms include: (1) All traffic is blocked – check if an implicit deny is catching everything; ensure there is a `permit ipv6 any any` at the end if needed. (2) Specific traffic is not filtered – verify the ACL entries are in the correct order; IPv6 ACLs process top-down, so place more specific entries before general ones. (3) Traffic is filtered in the wrong direction – confirm the direction parameter matches the traffic flow. For example, to block traffic from a host to a server, apply the ACL inbound on the interface facing the host.
A step-by-step diagnostic flow: 1. Identify the interface and direction where filtering should occur. 2. Use `show ipv6 interface` to confirm ACL application. 3.
Use `show access-list` to check hit counts. 4. Generate test traffic (e.g., ping, telnet) and observe hit counts. 5. If hits don't increment, use `debug ipv6 packet` (with caution) to see if packets are being dropped or forwarded.
Correlate with `show ipv6 route` to ensure routing is correct. Also, check for any other ACLs applied on the same interface or VLAN, as multiple ACLs can interact. Remember that IPv6 ACLs do not affect locally generated traffic (like SSH to the router itself) unless applied with `ipv6 traffic-filter` on the interface; for local traffic, use `ipv6 access-class` on the VTY lines.
Finally, ensure the ACL name is correctly spelled and that the ACL exists in the configuration; a missing ACL will cause the `ipv6 traffic-filter` command to be rejected with an error message like 'Access list does not exist'.
CCNA Exam Tips
Remember that 'ipv6 traffic-filter' is the IPv6 equivalent of 'ip access-group' for IPv4.
The ACL must be created before applying it; otherwise, the command is rejected.
Only one ACL per direction (in/out) per interface is allowed; applying a new one replaces the old.
The ACL is processed in order; an implicit 'deny ipv6 any any' exists at the end.
Common Mistakes
Forgetting to create the ACL before applying it, resulting in 'ACL not found' error.
Applying the ACL in the wrong direction (e.g., inbound instead of outbound).
Using 'ipv6 access-group' instead of 'ipv6 traffic-filter' (the correct command).
ipv6 traffic-filter [name] [in|out] vs ipv6 access-list [name]
The commands 'ipv6 traffic-filter' and 'ipv6 access-list' are often confused because they work together: one defines the filtering criteria (access-list) while the other applies that criteria to an interface (traffic-filter). Understanding their distinct roles is essential for correct IPv6 ACL deployment.
| Aspect | ipv6 traffic-filter [name] [in|out] | ipv6 access-list [name] |
|---|---|---|
| Scope | Interface-specific | Global (entire router) |
| Configuration Mode | Interface Configuration | Global Configuration |
| Purpose | Apply an existing IPv6 ACL to an interface | Define or modify IPv6 ACL entries |
| Typical Use | Enforce traffic filtering at a specific interface | Create named ACL rules for later application |
| Prerequisite | Requires a pre-defined IPv6 ACL | Must be executed before traffic-filter references it |
Use ipv6 traffic-filter [name] [in|out] when you need to activate a previously defined IPv6 access list on a particular interface and direction.
Use ipv6 access-list [name] when you need to create or edit the rules of an IPv6 access control list that will later be applied to an interface.
Platform Notes
In IOS-XE (e.g., Catalyst 9000 switches), the `ipv6 traffic-filter` command syntax is identical to classic IOS, but the ACL configuration may use `ipv6 access-list` with the same syntax. However, on some IOS-XE platforms, the ACL is stored in the running configuration and can be verified with `show ipv6 access-list`. On NX-OS (e.g., Nexus switches), the equivalent command is `ipv6 traffic-filter` as well, but ACLs are configured using `ipv6 access-list` with a different syntax (e.g., `permit ipv6 <src> <dst>`).
NX-OS also supports object-group-based ACLs. For ASA firewalls, IPv6 traffic filtering is done using `access-group` with an IPv6 ACL, but the ACL is created with `ipv6 access-list` and applied with `access-group <name> in/out interface <if_name>`. The ASA does not use `ipv6 traffic-filter`.
In IOS-XR, the command is `ipv6 access-group` (not `traffic-filter`), and ACLs are configured with `ipv6 access-list` in a similar manner. There are no significant differences between IOS 12.x, 15.x, and 16.x for this command; however, newer versions may support additional match criteria like flow-label or dscp. Always check the specific platform documentation for any nuances.
Related Commands
ipv6 access-list [name]
Creates or enters IPv6 access list configuration mode to define a named IPv6 access control list for filtering IPv6 traffic based on source/destination addresses, ports, and protocols.
show ipv6 interface [interface]
Displays detailed IPv6 configuration and status for an interface, including all IPv6 addresses, link-local address, NDP settings, RA flags (M/O), and whether the interface is forwarding IPv6 packets.
Practice for the CCNA 200-301
Test your knowledge with practice questions covering all CCNA 200-301 exam domains.
Practice CCNA 200-301 Questions