Access Switch IPv6

IPv6 access on switches is managed using IPv6 Access Control Lists (ACLs) to filter traffic based on source, destination, and protocol, ensuring secure and controlled network operations.

Overview of IPv6 Access Control

IPv6 ACLs allow switches to permit or deny IPv6 traffic traversing their interfaces. Each ACL contains one or more Access Control Entries (ACEs) specifying criteria for forwarding or dropping packets. Unlike IPv4, IPv6 ACLs are named rather than numbered, and IPv4 and IPv6 ACLs operate independently—they cannot share the same ACL or ACE configuration . ACLs can filter traffic inbound or outbound on a specific interface, and extended IPv6 ACLs can also filter based on upper-layer protocol information such as TCP/UDP ports for finer control .

Key IPv6 Features Affecting Access

• Global and Link-Local Addresses: Every interface has a globally routable IPv6 address and a link-local address for neighbor discovery and routing .
• Neighbor Discovery Protocol (NDP): Replaces ARP in IPv4 and uses ICMPv6 messages to discover neighbors and routers .
• SLAAC and DHCPv6: Clients can auto-configure addresses via SLAAC or receive stateful configuration via DHCPv6 . These features influence ACL design, as traffic filtering must account for link-local communications, router advertisements, and neighbor discovery messages.

Configuring IPv6 ACLs on Switches

Cisco IOS Switches

1. Define an IPv6 ACL using the ipv6 access-list command in global configuration mode.
2. Specify permit or deny rules for traffic based on source/destination addresses, protocol type, or port numbers.
3. Apply the ACL to an interface using the ipv6 traffic-filter or ipv6 access-class command for inbound or outbound traffic .
4. Verify ACL operation using commands like show ipv6 access-list to monitor hits and ensure correct filtering. Example:

ipv6 access-list BLOCK_TELNET deny tcp any any eq 23 permit ipv6 any anyinterface GigabitEthernet0/1 ipv6 traffic-filter BLOCK_TELNET in

This configuration blocks Telnet traffic while allowing other IPv6 traffic.

HPE/Aruba Switches

1. Enter configuration mode and configure IPv6 on SVIs or routed interfaces.
2. Create IPv6 ACLs to filter traffic for VLANs or routed interfaces.
3. Apply ACLs to interfaces for inbound or outbound filtering.
4. HPE/Aruba switches support dual-stack operation, allowing IPv4 and IPv6 ACLs to operate simultaneously but independently . HPE/Aruba switches also integrate OSPFv3 and Router Advertisement support, enabling the switch to act as a default gateway for IPv6 VLANs without additional RA servers.

Best Practices

• Use named ACLs for clarity and easier management.
• Apply ACLs close to the source to reduce unnecessary traffic on the network.
• Include explicit permit statements for essential IPv6 protocols like NDP and ICMPv6 to maintain network functionality.
• Regularly monitor ACL hits to verify effectiveness and adjust rules as needed.
• Plan for dual-stack networks if IPv4 is still in use, ensuring ACLs do not conflict . By following these guidelines, network administrators can secure IPv6 traffic on switches, maintain operational efficiency, and ensure compliance with enterprise security policies.