One protocol that you want to be especially careful with is ICMP v six.
Remember, in IP version four, we use ARP to determine the MAC address of a neighbor.
ARP is no longer used in IP version six neighbor discovery protocol or MDP is part of ICMP version six.
So if you have a blanket deny of IP version six inadvertently, it could affect the communication of
devices in your IP version six network.
ICMP is also used for path into you discovery, so don't just block ICMP Version six.
Be careful blocking that protocol in IP version four.
In some cases you don't want to block ICMP, but you can be a little bit more blasé blocking ICMP in
IP version four versus IP version six.
Be careful again that some protocols required for neighbor discovery and basic IP version six functionality
require ICMP version six.
Now IP Version six access lists once again are very similar to IP version four.
You need to be careful again with protocols that you used to an IP version four such as broadcasts and
ARP IP version six.
It doesn't use broadcasts, it uses multiple costs.
So to discover neighbors, we use the neighbor discovery protocol and multicast rather than using ops
and broadcasts.
IP Version six also includes new fields such as a flow label and extension headers, which are different
to IP version four.
IP version six access lists therefore allow you to match on traffic classes, flow labels, IPV six
and next header field source and Destination 128.
But IPV six addresses upper layer headers, higher layer protocol such as TCP and UDP and their relevant
port numbers, as well as flags such as Sun and ACH.
We also have ICMP version six types and codes that you could match on as well as IP version six extension
header values and types.
So be careful.
There are differences between IP version six access lists and IP version for access lists.
There are also limitations with IP version six access lists.
IP version six tends to have more tunnels than IP version four.
So as an example, you may have IP version six packets transported over an IP version for network using
GREE tunnels.
So be careful if you're trying to block IP version six packets using an IP version six access list and
that's tunnelled within a IP version for Geo Tunnel.
Your access list won't work in IP version for access lists.
Wildcard masks don't have to be contiguous.
In other words, it doesn't have to look like this.
You could match all odd IP addresses or all even IP addresses by manipulating the inverse mask of an
IP version for access list.
However, in IP version six, you create IP version six access lists using a prefix length number that
indicates the number of contiguous prefix mask bits.
That's very different to IP version four.
In IP version six access lists, the prefix length number represents the number of contiguous bits that
will be matched for that IP version six address prefix.
So we use a slash notation where the number after the slash indicates the number of bits of the prefix
length.
That means therefore that you can only match on an IP version six address prefix and cannot use just
contiguous masks with IP version six access lists.
In addition, it's a very common to have prefix lengths that are evenly divisible by four.
So you'd use things such as slash 48, slash 52, slash 56, slash 64 as an example.
And it's not a standard practice to have a prefix length that doesn't fall on a hex digit boundary.
That's very different again to IP version.
For IP version for addresses, you may have a slash 22, slash 23 slash 24, but then a slash 25 or
slash 26.
So unlike an IP version for where you don't just use slash eight or slash 16 or slash 24 or slash 32,
that tends to be the practice in IP version six.
So as an example, you'll match slash 60 for you matching on a hex digit boundary.
Remember, hex digits are for binary bits and length.
So we use slash 48, slash 52, slash 56.
Slash 60, slash 64.
Rather than something like slash SC2.
It's important to remember that excessive logging can negatively impact rider performance.
The root of CPU is involved when a log entry is created.
Therefore, be careful using the logging keyword.
Just like with IP version four, IP version six access list.
Don't deny packets originating from a router.
So an outbound access list on a router interface will not block router packets sent by that router.