IPv6 access lists on Cisco IOS: syntax, implicit rules and Neighbour Discovery

Why IPv6 needs its own ACLs

An IPv4 ACL does not touch IPv6 traffic. On a dual-stack network, every interface with an IPv4 ACL needs a matching IPv6 policy, or IPv6 becomes an unfiltered side door. This is a common gap: an organisation enables IPv6 on its LAN or gets it automatically from a provider, and its carefully written IPv4 rules simply do not apply. Background on IPv6 addressing is in IPv6 explained.

Syntax differences

• IPv6 ACLs are named only and there is just one kind, which behaves like an extended ACL: you can match source, destination, protocol, ports and more.
• Addresses use prefix lengths (2001:db8:10::/64) or host and any, not wildcard masks.
• They are applied to an interface with ipv6 traffic-filter NAME in|out, and to VTY lines with ipv6 access-class NAME in.
• Lines can match IPv6-specific fields such as extension headers and the flow label, and ICMPv6 message types by name.

ipv6 access-list GUEST6-IN
 sequence 10 permit udp 2001:db8:30::/64 host 2001:db8:1::53 eq domain
 sequence 20 deny ipv6 2001:db8:30::/64 2001:db8::/48 log
 sequence 30 permit tcp 2001:db8:30::/64 any eq 443
 sequence 40 permit tcp 2001:db8:30::/64 any eq www
 sequence 50 permit icmp any any nd-ns
 sequence 60 permit icmp any any nd-na
 sequence 70 deny ipv6 any any log
!
interface Vlan30
 ipv6 traffic-filter GUEST6-IN in

This mirrors a typical IPv4 guest policy: DNS to the internal resolver, no access to the organisation's own /48, web browsing allowed.

The hidden lines at the end

IPv4 needs ARP, which is not an IP packet and so never meets an IP ACL. IPv6 uses Neighbour Discovery (ND) instead, and ND runs over ICMPv6, so it does pass through IPv6 ACLs. To avoid breaking it by accident, every IPv6 ACL on Cisco IOS ends with three implicit lines:

permit icmp any any nd-na
permit icmp any any nd-ns
deny ipv6 any any

The trap: if you add your own deny ipv6 any any log at the end, which many engineers do out of IPv4 habit, it matches before the hidden ND permits. Neighbours can no longer resolve each other's addresses and IPv6 stops working on that interface. That is why the example above permits nd-ns and nd-na explicitly before its final deny.

ICMPv6 you should not block

ICMPv6 is much more important to IPv6 than ICMP is to IPv4. Besides neighbour solicitation and advertisement, keep these working where they apply:

Do block router advertisements arriving from places they should not come from. On switches, RA Guard does this at Layer 2, which is a better tool than a router ACL for stopping rogue routers on a LAN.

Real-world example: a law firm's silent IPv6

A law firm's provider enabled IPv6 on its business broadband, and the firm's router began advertising a prefix to the office LAN automatically. The firm's IPv4 ACLs blocked inbound remote desktop, but there was no IPv6 policy, and an external scan found a partner's PC reachable over IPv6. The IT support company wrote an IPv6 ACL for the internet interface mirroring the IPv4 policy. Their first version ended with deny ipv6 any any log and broke IPv6 to the router itself; adding explicit ND and packet-too-big permits fixed it. They now include an IPv6 section in every firewall and ACL review.