IPV6 ACL

[libra_ali786]

Ipv6 access-list net

Permit ipv6 2001:DB8:AD59:BA21::/64   2001:DB8:C0AB:BA14::/64

Permit tcp 2001:DB8:AD59:BA21::/64   2001:DB8:C0AB:BA13::/64 eq telnet

Permit tcp 2001:DB8AD59:BA21::64 any eq http

Permit ipv6 2001:DB8:AD59::/48 any

deny ipv6 any any log

Which statement is true and why?

1. A packet with a source address of 2001:DB80:AD59:BA21:101:CAB:64:38 destined to port 80 will be permitted.
2. A packet with a source address of 2001:DB8:AD59:ACC0:2020:882:DB8:1125 will be denied.
3. The denied entries will be logged because of the explicit deny ipv6 any any log line.
4. HTTPS traffic from the 2001:DB8:AD59:BA21::/64 subnet will automatically be permitted along with HTTP traffic.

[Seb Rupik]

Hi there,

Statement 3 is the only correct one. Although every ACL ends with an implicit deny, the final ACE is an explicit deny which also stipulates that every denied packet is also logged.

cheers,

Seb.

[Seb Rupik · Accepted solution]

I should probably explain the others too.
Statements:
1) False. The network address for this host is 2001:DB80:AD59:BA21::/64 . Note the position of the 0 in the second hextet. The ACL shows an compressed IPv6 address which when expanded equals: 2001:0DB8:AD59:BA21::/64

2) False. This host is permitted by the last permit ACE.

3) True.

4) False (~True) : For the purpose of this ACL I assumed that 'HTTP traffic' actually means traffic destined to a HTTP port. The destination port in the third ACE is TCP/80, therefore it does not permit TCP/443 . However such traffic would be permitted by the fourth ACE.

[giuseppepratola]

Sorry but answer 1 why it is not correct?

IP address	2001:db8:ad59:ba21::/64
type	GLOBAL-UNICAST (reserved for documentation purpose (2001:db8::/32) [rfc3849][IANA])
network	2001:db8:ad59:ba21::
Prefix length	64
network range	2001:0db8:ad59:ba21:0000:0000:0000:0000- 2001:0db8:ad59:ba21:ffff:ffff:ffff:ffff
total IP addresses	18446744073709551616

[Seb Rupik]

Hi Giuseppe,

The question mentioned a source IP of 2001:DB80:AD59:BA21:101:CAB:64:38 /64 , which gives a subnet of:

2001:DB80:AD59:BA21::/64

This is different to the subnet you mention due to the position of the zero in the second hextet:

The question:	Your example and the also the ACL
:DB80:	:0DB8:

These are totally different addresses.

cheers,

Seb.