Goldfish Networks wordmark
AdvancedPublished 2026-08-20

CCNA Foundations: IPv6 ACLs — Filter Without Breaking Discovery

Archive lab

Build a dual-stack branch-to-datacenter topology with IPv6 static routing in place. Implement a named IPv6 ACL on the server-facing interface that permits an approved client while denying an unapproved source, and explicitly permits Neighbor Discovery (ND) so the LAN continues to function. Verify that the allowed source can reach the server over IPv6 while the unapproved source fails, without disrupting IPv6 neighbor resolution.

Track
Est. time
55 minutes
Difficulty
Advanced
Topics

Learning objectives

  • Create and order a named IPv6 ACL with explicit ND allowances (nd-ns and nd-na) before deny statements
  • Apply an IPv6 ACL using ipv6 traffic-filter in the correct direction and interface
  • Validate IPv6 forwarding end-to-end from hosts and confirm that ND is intact
  • Contrast IPv6 ACL application with IPv4 (named-only ACL, ipv6 traffic-filter vs ip access-group)

Troubleshooting focus

  • If all IPv6 traffic to the server fails after applying the ACL, check that the ACL explicitly permits icmp any any nd-ns and nd-na before any deny
  • If pings from the approved source fail but IPv4 works, confirm ipv6 traffic-filter is applied on the server-facing interface in the correct direction (outbound toward the server in this design)
  • If IPv6 routing breaks broadly, verify ipv6 unicast-routing is enabled and static IPv6 routes are present and correct on both routers
  • If the ACL appears to have no effect, ensure you used ipv6 access-list (named) and ipv6 traffic-filter, not ip access-group

Topology

Subscribe to preview this lab's topology.

See plans

Related labs

More hands-on Cisco Modeling Labs practice on the same track and topics.

Grade your work

How this lab is graded
  • Build it your way. Where a lab lets you choose a value — a VLAN name, an interface description — grading checks that you configured it, not which name you picked. Names that another line has to reference, like an ACL applied with access-class, are stated in the guide and do have to match.
  • Addresses, modes and protocol keywords are exact. An IP address, a subnet mask, switchport mode trunk, an encapsulation — these carry the meaning of the lab, so they are graded as written in the guide.
  • Grading reads your saved configuration. Export the lab from CML after you have configured it, and make sure anything you set is in the running-config — a change that only exists in a terminal session never reaches the grader.
  • You can submit as many times as you like. Your best score stands, and each attempt tells you which checks passed so you can work the gaps.
  • Scored something you believe is correct? Use Report an issue on this page — that is exactly how the grading fixes in the changelog got found.

Create a free account to submit your lab for grading.

Create a free account
Found a problem with this lab?

Please sign in to report a problem — tying it to your attempts lets us reproduce and fix it faster.