IP version 6 access lists you know some of the way to IP version for access lists or apply it to interfaces
either in an inbound or outbound direction.
You could apply a IP version 6 access list to a router interface such as gigabit 00 or serial 1 slash
zero better.
They could also be applied to switched of virtual interfaces on a switch such as interface land to also
remember that because of ships in the night IP version for an IP version 6 are independent of each other.
So you could have both an IP version for inbound and outbound access list as well as an IP version 6
inbound and outbound access list on the same interface.
The IP version 4 axis lists have no effect on IP version 6 packets and IP version 6 access lists have
no effect on IP version 4 packets in the same way as IP version for an IP version 6.
It makes sense to apply access lists on ingress rather than a great interfaces to provide more security.
So on an internet facing router you want an inbound access list.
Denying traffic to the network and to the router rather than in a grace interface where the router is
exposed to the Internet.
So rather deny before processing if required instead of processing packets and then dropping them.
It's less secure to use an outbound access list on the perimeter routers internal interface rather put
it on the extolling to face and block traffic before it's processed by the routers writing table.
When traffic is leaving the internal or trusted network to go into the internet apply it on the outbound
interface.
So on the Internet facing interface on a router traffic that arise from internet is processed ingress
or inbound traffic leaving the internal network to go to the Internet is processed outbound on that
Internet facing interface as always with access lists.
The hard part is determining how to filter traffic.
Same applies to IP version for an IP version 6.
What are you going to permit and what are you going to deny.
Generally you want to permit only certain protocols or certain applications and block everything else.
So in other words anything that is not permitted will be blocked.
And that's why by default on Cisco devices there's a denying any any at the end of an access list.
So for both IP version 4 and IP version 6 there's an implied deny any any.
So for IP version 6 we have denied IPV six any any as the last rule in an access list.
So unless you explicitly permit something it's going to be denied.
Now you can't simply copy your IP version for access lists and apply them to IP version 6 because you
have different protocols and you perhaps have different requirements for IP version 6 versus IP version
4.
It makes more sense to start with a brand new IP version 6 policy and only permit specific IP version
6 protocols rather than trying to copy your IP version 4 access list.
So you need to decide which IP version 6 packets and protocols are permitted into your network and which
protocols and packets are permitted out of your network.