12.2 IPv6 and Extended ACLs

Question 1

What are the two types of IPv6 ACLs

Answer 1

Router ACLs filter inbound and outbound traffic on layer 3 interfaces (e.g., routed ports, switch virtual interfaces (SVIs), etc.)
Port ACLs filter inbound traffic on layer 2 interfaces.

Question 2

Router(config)#ipv6 access-list [name]

Answer 2

Creates an IPv6 ACL with the specified name and enters the IPv6 ACL configuration mode.

Question 3

Router(config-ipv6-acl)#permit|deny [protocol] [source] [destination]

Router(config-ipv6-acl)#permit|deny [protocol] [source] [destination] eq [port]

Router(config-ipv6-acl)#permit|deny [protocol] [source] [destination] established

Answer 3

Configures an ACL entry in the IPv6 ACL.
protocol is the name or number of an IPv6 protocol, such as:
tcp
udp
icmp
source and destination can be either a single host, network, or any
The eq keyword and port argument specifies only packets on the given port number.
The established keyword indicates that traffic will be permitted only if the TCP ACK or reset (RST) bits are set, which indicate that the packet is a response to a request that originated from an internal host.

Question 4

Router(config-if)#ipv6 traffic-filter [name] in|out

Answer 4

Applies the IPv6 ACL to an interface.
name is the name of the ACL that has been configured.
Use the in or out keyword to specify which direction to apply the rule.

Question 5

Router(config-if)#ipv6 access-class [name] in|out

Answer 5

Applies the IPv6 ACL to a line.
name is the name of the ACL that has been configured.
Use the in or out keyword to specify which direction to apply the rule

Question 6

Router#show ipv6 access-list

Answer 6

Displays the saved IPv6 access lists.

Question 7

When do you use an inverse wildcard mask

Answer 7

used with IPv4 access control lists (ACLs) to identify which parts of an IP address are available for examination

Question 8

Router(config)#ip access-list extended [name]

Answer 8

Creates a named extended ACL. The action statements go on separate lines.

Question 9

Router(config)#access-list [number] permit icmp [source] [destination] [icmp type]

Answer 9

Configures extended ACL entries for ICMP packets.

Question 10

Router(config)#access-list [number] deny ip any any log

Answer 10

Configures permit/deny for an informational logging message about the packet that matches the entry to be sent to the console.

Question 11

Router(config-if)#ip access-group [name|number] in|out

Answer 11

Applies the ACL to an interface.

Question 12

Router(config)#access-list [number] permit|deny [protocol] [source] [destination]

Router(config)#access-list [number] permit|deny [protocol] [source] [destination] eq [port]

Router(config)#access-list [number] permit|deny [protocol] [source] [destination] established

Router(config)#access-list [number] permit|deny [protocol] [source] [destination] range [min port range] [max port range]

Answer 12

Creates an extended ACL.