IPv6 Template ACL

When user profiles are configured using vendor-specific attribute (VSA) Cisco AV-pairs, similar per-user IPv6 ACLs may be replaced by a single template ACL. That is, one ACL represents many similar ACLs. By using IPv6 template ACLs, you can increase the total number of per-user ACLs while minimizing the memory and Ternary Content Addressable Memory (TCAM) resources needed to support the ACLs.

The IPv6 Template ACL feature can create templates using the following ACL fields:

  • IPv6 source and destination addresses

  • TCP and UDP, including all associated ports (0 through 65535)

  • ICMP neighbor discovery advertisements and solicitations

  • IPv6 DSCP with specified DSCP values

ACL names are dynamically generated by this feature; for example:

  • 6Temp_#152875854573--Example of a dynamically generated template name for a template ACL parent

  • Virtual-Access2.32135#152875854573--Example of a child ACL or an ACL that has not yet been made part of a template.

Information About IPv6 ACL—Template ACL

IPv6 Template ACL

When user profiles are configured using vendor-specific attribute (VSA) Cisco AV-pairs, similar per-user IPv6 ACLs may be replaced by a single template ACL. That is, one ACL represents many similar ACLs. By using IPv6 template ACLs, you can increase the total number of per-user ACLs while minimizing the memory and Ternary Content Addressable Memory (TCAM) resources needed to support the ACLs.

The IPv6 Template ACL feature can create templates using the following ACL fields:

  • IPv6 source and destination addresses

  • TCP and UDP, including all associated ports (0 through 65535)

  • ICMP neighbor discovery advertisements and solicitations

  • IPv6 DSCP with specified DSCP values

ACL names are dynamically generated by this feature; for example:

  • 6Temp_#152875854573--Example of a dynamically generated template name for a template ACL parent

  • Virtual-Access2.32135#152875854573--Example of a child ACL or an ACL that has not yet been made part of a template.

How to Enable IPv6 ACL—Template ACL

Enabling IPv6 Template Processing

SUMMARY STEPS

  1. enable
  2. configure terminal
  3. access-list template [number-of-rules ]
  4. exit
  5. show access-list template {summary | aclname | exceed number | tree }

DETAILED STEPS

  Command or Action Purpose

Step 1

enable

Example:


Router> enable

Enables privileged EXEC mode.

  • Enter your password if prompted.

Step 2

configure terminal

Example:


Router# configure terminal

Enters global configuration mode.

Step 3

access-list template [number-of-rules ]

Example:


Router(config)# access-list template 50

Enables template ACL processing.

  • The example in this task specifies that ACLs with 50 or fewer rules will be considered for template ACL status.

  • The number-of-rules argument default is 100.

Step 4

exit

Example:


Router(config)# exit

Exits global configuration mode and places the router in privileged EXEC mode.

Step 5

show access-list template {summary | aclname | exceed number | tree }

Example:


Router# show access-list template summary

Displays information about ACL templates.

Configuration Examples for IPv6 ACL—Template ACL

Example: IPv6 Template ACL Processing

In this example, the contents of ACL1 and ACL2 are the same, but the names are different: 


ipv6 access-list extended ACL1 (PeerIP: 2001:1::1/64) 
permit igmp any                  2003:1::1/64 
permit icmp 2002:5::B/64         any 
permit udp  any                  host 2004:1::5 
permit udp  any                  host 2002:2BC::a 
permit icmp host 2001:BC::7      host 2003:3::7 
ipv6 access-list extended ACL2 (PeerIP: 2007:2::7/64) 
permit igmp any                  2003:1::1/64 
permit icmp 2002:5::B/64         any 
permit udp  any                  host 2004:1::5 
permit udp  any                  host 2002:2BC::a 
permit icmp host 2001:BC::7      host 2003:3::7

The template for these ACLs is as follows: 


ipv6 access-list extended Template_1 
permit igmp any                  2003:1::1/64 
permit icmp 2002:5::B/64         any 
permit udp  any                  host 2004:1::5 
permit udp  any                  host 2002:2BC::a 
permit icmp host 2001:BC::7      host 2003:3::7

Additional References

Related Documents

Related Topic

Document Title

IPv6 addressing and connectivity

IPv6 Configuration Guide

IPv6 commands

Cisco IOS IPv6 Command Reference

Cisco IOS IPv6 features

Cisco IOS IPv6 Feature Mapping

Standards and RFCs

Standard/RFC

Title

RFCs for IPv6

IPv6 RFCs

MIBs

To locate and download MIBs for selected platforms, Cisco IOS releases, and feature sets, use Cisco MIB Locator found at the following URL:

http://www.cisco.com/go/mibs

Technical Assistance

Description

Link

The Cisco Support and Documentation website provides online resources to download documentation, software, and tools. Use these resources to install and configure the software and to troubleshoot and resolve technical issues with Cisco products and technologies. Access to most tools on the Cisco Support and Documentation website requires a Cisco.com user ID and password.

http://www.cisco.com/cisco/web/support/index.html

Feature Information for IPv6 ACL—Template ACL

The following table provides release information about the feature or features described in this module. This table lists only the software release that introduced support for a given feature in a given software release train. Unless noted otherwise, subsequent releases of that software release train also support that feature.

Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to www.cisco.com/go/cfn. An account on Cisco.com is not required.
Table 1. Feature Information for IPv6 ACL—Template ACL

Feature Name

Releases

Feature Information

IPv6 ACL—Template ACL

Cisco IOS XE Release 3.2S

This feature allows similar per-user IPv6 ACLs to be replaced by a single template ACL.

The following commands were introduced or modified: access-list template , show access-list template .