1

I have a Huawei 6851 and this is my config

acl ipv6 number 3006
description MY-IPv6
rule 10 permit ipv6 source 2001:x:x:x::x:x/112
rule 20 deny ipv6 destination 2001:x:x:x::x:y/128
rule 30 permit ipv6


interface 10GE1/0/24
undo portswitch
description MY
ipv6 enable
ip address 192.168.50.2 255.255.255.252
ipv6 address 2001:x:x:x::x:y/112
traffic-filter ipv6 acl 3006 inbound
traffic-filter acl 3006 inbound
device transceiver 10GBASE-FIBER

I can still ping 2001:x:x:x::x:y/128 and when I check statistics it does not match the acl.

Shall I enable something else?

Improve this question
3
  • At a first glance I would think you'd need to set this as an outbound filter on the port. But you're not telling us what the source of your pings is, so we can't tell for sure.
    – Teun Vink ♦
    Feb 8 at 11:22
  • the source of ips are out of my network and they are from external sources , why should is et it as outbound?
    – Blackmetal
    Feb 8 at 13:27
  • also, i tried outbound but it did not work!
    – Blackmetal
    Feb 8 at 15:16

2 Answers 2

Reset to default
1

Remember that ACLs exit on the first match. You have not really provided enough information, but if the packet source falls within:

rule 10 permit ipv6 source 2001:x:x:x::x:x/112

then the ACL will never reach:

rule 20 deny ipv6 destination 2001:x:x:x::x:y/128

to be denied on the packet destination. If the packet matches rule 10, no following rules will be tested. You probably want to swap rule 10 with rule 20.

Improve this answer
0

This approach is incorrect. You need to create a traffic policy for the same.

Step 1. Create an ACL containing the list of IPs.

Step 2. Create a classifier and link it to the ACL.

Step 3. Create suitable behaviors (permit, deny, etc)

Step 4. Bind all of them in a traffic policy.

Step 5. Apply the traffic policy with egress/ingress parameters on the interface.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.