IP version six access lists in a similar way to IP version for access lists or applied to interfaces
either in an inbound or outbound direction.
You could apply a IP version six axis list to a router interface such as gigabit zero zero or serial
1/0.
But they can also be applied to switch to virtual interfaces on a switch such as interface of VLAN two.
Also remember that because of ships in the night, IP version four and IP version six are independent
of each other.
So you could have both an IP version for inbound and outbound access list as well as an IP version six
inbound and outbound access list on the same interface.
The IP version for access lists have no effect on IP version six packets and IP version six access lists
have no effect on IP version four packets in the same way as IP version four.
In IP version six, it makes sense to apply access lists on ingress rather than egress interfaces to
provide more security.
So on an internet facing router, you want an inbound access list denying traffic to the network and
to the router rather than an egress interface where the router is exposed to the internet.
So rather deny before processing if required.
Instead of processing packets and then dropping them, it's less secure to use an outbound access list
on a perimeter routers internal interface rather put it on the external interface and block traffic
before it's processed by the routers routing table.
When traffic is leaving the internal or trusted network to go into the internet, apply it on the outbound
interface.
So on the internet facing interface, on a router, traffic that arrives from the Internet is processed
ingress or inbound traffic.
Leaving the internal network to go to the internet is processed outbound on that internet facing interface.
As always, with access lists, the hard part is determining how to filter traffic.
Same applies to IP version four and IP version six.
What are you going to permit and what are you going to deny?
Generally you want to permit only certain protocols or certain applications and block everything else.
So in other words, anything that is not permitted will be blocked.
And that's why by default on Cisco devices, there's a deny any any at the end of an access list.
So for both IP version four and IP version six, there's an implied deny any any.
So for IP version six, we have deny IPv6 any any as the last rule in an access list.
So unless you explicitly permit something, it's going to be denied.
Now you can't simply copy your IP version for access lists and apply them to IP version six because
you have different protocols and you perhaps have different requirements for IP version six versus IP
version four.
It makes more sense to start with a brand new IP version six policy and only permit specific IP version
six protocols rather than trying to copy your IP version for access list.
So you'll need to decide which IP version six packets and protocols are permitted into your network
and which protocols and packets are permitted out of your network.