UMN:CLI
User Manual
V8102
284
To activate/deactivate the ND inspection function on a VLAN, use the following command.
Command
Mode
Description
ipv6 nd inspection vlan
VLANS
Global
Activates ND inspection on a VLAN.
VLANS: VLAN ID (1-4094)
no ipv6 nd inspection vlan
VLANS
Deactivates ND inspection on a VLAN.
8.2.10.1
ND Access List
You can exclude a given range of IP addresses from the ND inspection using ND access
lists. ND access lists are created by the
ipv6 nd access-list
command on the
Global
Configuration
mode. ND access list permits or denies the ND packets of a given range of
IPv6 addresses.
To create/delete ND access control list (ACL), use the following command.
Command
Mode
Description
ipv6 nd access-list
NAME
Global
Opens ND ACL configuration mode and creates a ND
access list.
NAME: ND access list name
no ipv6 nd access-list
NAME
Deletes a ND access list.
ipv6 nd access-list delete all
Deletes all ND access lists.
After opening
ND Access List Configuration
mode, the prompt changes from
SWITCH(config)# to SWITCH(config-nd-acl[
NAME
])#. After opening
ND ACL Configura-
tion
mode, a range of IPv6 addresses can be configured to apply ND inspection.
By default, ND Access List discards the Neighbor Discovery protocol packets, of all IPv6
addresses and MAC addresses.
To specify the IPv6 address and MAC address to forward the ND messages, use the fol-
lowing command.
Command
Mode
Description
permit ipv6
{
host X:X::X:X
|
X:X::X:X/M
|
any
}
mac
{
any
|
host
MACADDR
}
ND-ACL
Permits ND packets based on their IPv6 address and
MAC address, which have not learned before on ND
inspection table.
mac any: ignores sender MAC address
ipv6 any: ignores sender IPv6 address
host: sender host
X:X::X:X: sender IPv6 address
X:X::X:X/M: sender IPv6 network address
MACADDR: sender MAC address
permit
ipv6
range
X:X::X:X
X:X::X:X mac any
Permits ND packets of a given range of IPv6 address-
es.
i
