One protocol that you want to be especially careful with is ICMP V-6 remember an IP version 4 we use
up to determine the MAC address of a neighbor.
OP is no longer used in IP version 6.
Maybe discovery protocol.
NDP is part of ICMP version 6.
So if you have a blanket deny of IP version 6 inadvertently it could affect the communication of devices
in your IP version 6 network ICMP is also used for parthe into discovery.
So don't just block ICMP version 6.
Be careful blocking that protocol in IP version 4.
In some cases you don't want to block ICMP but you can be a little bit more Lassez blocking ICMP IP
version 4 versus IP version 6.
Be careful again that some protocols required for discovery and basic IP version 6 functionality require
ICMP version 6 IP version 6 axis lists once again very similar to IP version 4.
You need to be careful again with protocols that you use to an IP version for such a broad costs and
OP IP version 6 doesn't use broad costs.
It uses multi costs.
So to discover neighbors we use a discovery protocol and multi-course rather than using ops and port
costs IP version 6 also includes new fields such as a flow label and extension headers which are different
to IP version for IP version 6 axis lists.
They allow you to match on traffic Klaas's flow labels IPV 6 and next head a field source and destination
128 bit IPV 6 addresses Apulia headers Khayelitsha protocol such as TZP and UDP and the relevant port
numbers as well as flags such as sin and Ach.
We also have ICMP version 6 types and codes that you could match shown as well as IP version 6 extension
head of valleys and types.
So be careful.
There are differences between IP version 6 access lists an IP version 4 access lists that also limitations
with IP version 6 access lists IP version 6 tends to have more tunnels an IP version 4.
So as an example you may have IP version 6 packets transported over an IP version 4 network using GRV
tunnels.
So be careful if you try to block IP version 6 packets using an IP version 6 access list and that's
tunneled within a IP version for GOP tunnel your access list won't work in IP version for access lists
wildcard mosques don't have to be contiguous.
In other words it doesn't have to looked like this.
You could match all odd IP addresses or even IP addresses by manipulating the inverse mosque of an IP
version 4 access list.
However in IP version 6 you correct IP version Sixaxis list using a prefix lenth a number that indicates
the number of contiguous Prefect's mosque.
Buts that's very different to IP version for an IP version 6 access lists the Prefect's Linta number
represents the number of contiguous bits that will be matched for that IP version 6 address Prefect's.
So we use a slash notation with a number off to the slash indicates the number of bits of the Prefect's
linked.
That means therefore that you can only match on an IP version 6 address Prefect's and can not use discontiguous
mosques with IP version 6 access lists.
In addition it's very common to have prefix lengths that are evenly divisible by four.
So you'd use things such as 48 slash 52 slash 56 slash 64 as an example.
And it's not a standard practice to have a prefix length that doesn't fall on a hex digit boundary.
That's very different again to IP version 4 IP version for addresses you may have a slash 20 to slash
23 slash 24.
But then a slash 25 or 26.
So unlike an IP version for where you don't just use slash a tool slash 16 or slice 24 will slash 32.
That tends to be the practice in IP version 6.
So as an example you will match slushed 64 you matching on a hex digit boundary.
Remember hex digits are for binary bits in length so we use slash 48 slash 52 slash 56 slash 60 slash
64 rather than something like Slash 62.
It's important to remember that excessive logging can negatively impact Rodda performance.
The wrote a CPA is involved when a log entries is created they therefore be careful using the logging
keyword just like with IP vision for IP version 6 access list don't deny packets originating from a
router.
So an outbound access list on a route interface will not block rodded packets sent by that router.