The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.
The IPv6 ACL Undetermined-Transport Support feature helps in dropping misconfigured packets where the complete upper layer header is not present.
The undetermined-transport option is supported only for Cisco Application Control Engines (ACE) with deny action and IPv6 protocol.
Undetermined transport is not applied on nonfirst fragment packets.
Unintended misconfigurations by users or malicious attacks on the network may cause operational problems for hosts on the network.
Upper layer header is placed at the end of Extended Header (EH) chain in IPv6 packet, as it described in RFC 2460. If the complete upper layer header is not present in the IPv6 packet, then the router cannot process the packet. These packets may be misconfigured, corrupted, or malicious packets.
You may choose to drop these packets using IPv6 ACL with undetermined-transport option.
| Command or Action | Purpose | |
|---|---|---|
|
Step 1 |
enable Example: |
Enables privileged EXEC mode.
|
|
Step 2 |
configure terminal Example: |
Enters global configuration mode. |
|
Step 3 |
ipv6 access-list acl-name Example: |
Configures IPv6 access list. |
|
Step 4 |
deny ipv6 {src-addr | any} {dest-addr | any} [undetermined-transport] Example: |
Sets deny condition for an IPv6 access list as undermined transport. |
|
Step 5 |
end Example: |
Returns to privileged EXEC mode. |
Device> enable
Device# configure terminal
Device(config)# ipv6 access-list acl1
Device(config-ipv6-acl)# deny ipv6 2001:DB8:0300:0201::/32 2001:DB8:1:1::/64 undetermined-transport
Device(config-ipv6-acl)# end
|
Related Topic |
Document Title |
|---|---|
|
Cisco IOS commands |
|
|
IP access list commands |
Cisco IOS Security Command Reference |
|
Configuring IP access lists |
“Creating an IP Access List and Applying It to an Interface” |
|
Standards/RFCs |
Title |
|---|---|
|
RFC 2460 |
Internet Protocol, Version 6 (IPv6) Specification |
|
Description |
Link |
|---|---|
|
The Cisco Support and Documentation website provides online resources to download documentation, software, and tools. Use these resources to install and configure the software and to troubleshoot and resolve technical issues with Cisco products and technologies. Access to most tools on the Cisco Support and Documentation website requires a Cisco.com user ID and password. |
The following table provides release information about the feature or features described in this module. This table lists only the software release that introduced support for a given feature in a given software release train. Unless noted otherwise, subsequent releases of that software release train also support that feature.
Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to www.cisco.com/go/cfn. An account on Cisco.com is not required.|
Feature Name |
Releases |
Feature Information |
|---|---|---|
|
IPv6 ACL Undetermined-Transport Support |
Cisco IOS XE Release 3.15 |
The IPv6 ACL Undetermined-Transport Support feature helps in dropping misconfigured packets, where the complete upper layer header is not present. No commands were introduced or modified. |
Feedback