05-27-2010 07:23 AM - edited 03-06-2019 11:17 AM
Hi there,
I am currently using a C3560-24TS running c3560-ipbase-mz.122-25.SEE2 for a top of rack access switch.
From what I can see, to use ipv6 based access-lists I would need to upgrade to the advanced IP services image.
I was wondering if any one could suggest a ninja like way to enforce the dropping of ipv6 packets without having to change the image running on the switch?
This is to prevent hosts sharing the same switch from making ipv6 based comms.
Best Regards
D
05-27-2010 09:05 PM
Hi there,
I am currently using a C3560-24TS running c3560-ipbase-mz.122-25.SEE2 for a top of rack access switch.
From what I can see, to use ipv6 based access-lists I would need to upgrade to the advanced IP services image.
I was wondering if any one could suggest a ninja like way to enforce the dropping of ipv6 packets without having to change the image running on the switch?
This is to prevent hosts sharing the same switch from making ipv6 based comms.
Best Regards
D
Hi D,
IOS are the codes in the switches which can perform the commands which are designed in those IOS,If ipv6 needs advanced ip services image you need to have that image in order to use ip v6 acl in the switch because ip services image is not build to understand the ip v6 commands.
Hope to Help !!
Ganesh.H
06-03-2010 07:37 AM
A colleague suggsted possibly doing this on the ethernet header type instead :
mac access-list extended IPV6_PACKET
permit any any 0x86dd 0x0
vlan access-map BLOCK_IPV6 10
match mac address IPV6_PACKET
action drop
vlan access-map BLOCK_IPV6 20
action forward
vlan filter BLOCK_IPV6 vlan-list <...>
Does anyone have any experience in using the above before I have a go in a test environment?
Cheers
Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: