华为交换机：使用高级ACL6过滤特定IPv6报文示例（ACLv6）

华为交换机：使用高级ACL6过滤特定IPv6报文示例（ACLv6）

组网需求
如图1所示，Switch通过GE1/0/0接口连接用户。要求Switch能对来自用户的特定IPv6报文（源IPv6地址为fc01::2/64、目的IPv6地址为fc01::1/64的IPv6报文）进行过滤，并拒绝该报文通过。
配置思路
采用如下思路在Switch上进行配置：
配置高级ACL6和基于ACL6的流分类，使设备可以对特定IPv6报文（源IPv6地址为fc01::2/64、目的IPv6地址为fc01::1/64的IPv6报文）进行过滤。
配置流行为，拒绝匹配上ACL6的报文通过。
配置并应用流策略，使ACL6和流行为生效。
操作步骤
1、使能IPv6转发能力，并配置接口加入VLAN以及VLANIF接口的IPv6地址。
<HUAWEI> system-view
[HUAWEI] sysname Switch
[Switch] ipv6
[Switch] vlan batch 10
[Switch] interface gigabitethernet 1/0/0
[Switch-GigabitEthernet1/0/0] port link-type trunk
[Switch-GigabitEthernet1/0/0] port trunk allow-pass vlan 10
[Switch-GigabitEthernet1/0/0] quit
[Switch] interface vlanif 10
[Switch-Vlanif10] ipv6 enable
[Switch-Vlanif10] ipv6 address fc01::1 64
[Switch-Vlanif10] quit
2、配置高级ACL6和基于ACL6的流分类，并配置流行为和流策略，再在接口GE1/0/0的入方向应用流策略，用于拒绝源IPv6地址为fc01::2/64、目的IPv6地址为fc01::1/64的IPv6报文通过。
[Switch] acl ipv6 number 3001
[Switch-acl6-adv-3001] rule deny ipv6 source fc01::2/64 destination fc01::1/64
[Switch-acl6-adv-3001] quit
[Switch] traffic classifier class1
[Switch-classifier-class1] if-match ipv6 acl 3001
[Switch-classifier-class1] quit
[Switch] traffic behavior behav1
[Switch-behavior-behav1] deny
[Switch-behavior-behav1] statistic enable
[Switch-behavior-behav1] quit
[Switch] traffic policy policy1
[Switch-trafficpolicy-policy1] classifier class1 behavior behav1
[Switch-trafficpolicy-policy1] quit
[Switch] interface gigabitethernet 1/0/0
[Switch-GigabitEthernet1/0/0] traffic-policy policy1 inbound
[Switch-GigabitEthernet1/0/0] quit
3、验证配置结果
# 查看ACL6的配置信息。
[Switch] display acl ipv6 3001
Advanced IPv6 ACL 3001, 1 rule
 rule 0 deny ipv6 source FC01::/64 destination FC01::/64
# 查看流分类的配置信息。
[Switch] display traffic classifier user-defined
  User Defined Classifier Information:                                          
   Classifier: class1                                                           
    Precedence: 5                                                               
    Operator: OR                                                                
    Rule(s) : if-match ipv6 acl 3001
Total classifier number is 1      
# 查看流策略的配置信息。
[Switch] display traffic policy user-defined
  User Defined Traffic Policy Information:                                      
  Policy: policy1                                                               
   Classifier: class1                                                           
    Operator: OR                                                                
     Behavior: behav1                                                           
      Deny                                                                      
      Statistic: enable                                                         
Total policy number is 1     
# PC1无法访问网络，在Switch上执行命令display traffic policy statistics interface gigabitethernet 1/0/0 inbound可以看到匹配的报文与丢弃的报文数一样多，匹配ACL3001的报文全部被丢弃。

ACL（列表、list、全）acllist
http://www.zh-cjh.com/wenzhangguilei/1514.html
文章归类、所有文章列表、LISTLIST
http://www.zh-cjh.com/wangzhangonggao/2195.html

IPv6（列表、list、全）ipv6list
http://www.zh-cjh.com/wenzhangguilei/1534.html
文章归类、所有文章列表、LISTLIST
http://www.zh-cjh.com/wangzhangonggao/2195.html