8.7.4 Packet Tracer - Configure IPv6 ACLs Answers

R1(config)# ipv6 access-list BLOCK_HTTP
	R1(config)# deny tcp any host 2001:db8:1:30::30 eq www
R1(config)# deny tcp any host 2001:db8:1:30::30 eq 443

R1(config)# permit ipv6 any any

R1(config)# interface GigabitEthernet0/1

R1(config-if)# ipv6 traffic-filter BLOCK_HTTP in

R1(config)# ipv6 access-list BLOCK_ICMP

R3(config)# deny icmp any any

R3(config)# permit ipv6 any any

R3(config)# interface GigabitEthernet0/0

R3(config-if)# ipv6 traffic-filter BLOCK_ICMP out

! ==============================================================
!--- 8.7.4 Packet Tracer - Configure IPv6 ACLs
!--- ANSWER SCRIPT FOR ROUTER R1
!--- Usage: copy this whole file and paste it into the R1 terminal (start at the R1> prompt). Every line beginning with "!" is a comment; IOS ignores it, so pasting a comment by accident is harmless.
! ==============================================================

enable
configure terminal

! --------------------------------------------------------------
!--- Part 1: Configure, Apply, and Verify the BLOCK_HTTP IPv6 ACL.
! --------------------------------------------------------------

!--- Begin the named IPv6 ACL.
ipv6 access-list BLOCK_HTTP

!--- Block HTTP (port 80/www) from any source to Server3 — mitigates the DoS traffic reported from 2001:db8:1:11::/64.
 deny tcp any host 2001:db8:1:30::30 eq www

!--- Block HTTPS (port 443) from any source to Server3.
 deny tcp any host 2001:db8:1:30::30 eq 443

!--- Permit everything else — IPv6 ACLs also end with an implicit "deny all" (plus an implicit permit for
!--- ICMPv6 neighbor discovery), so this explicit permit keeps all other traffic, including PC1's own
!--- access to Server3, unaffected.
 permit ipv6 any any
 exit

! --------------------------------------------------------------
!--- Part 2: Apply the ACL to the Correct Interface.
! --------------------------------------------------------------

!--- Apply inbound on G0/1 — the interface facing 2001:db8:1:11::/64 (PC2's LAN), closest to the source of the DoS traffic.
interface gigabitethernet 0/1
 ipv6 traffic-filter BLOCK_HTTP in
 exit

end

! --------------------------------------------------------------
!--- Save the configuration to NVRAM. (Press Enter when prompted for the destination filename.)
! --------------------------------------------------------------
copy running-config startup-config


! ==============================================================
!--- Verification:
!---   show ipv6 access-list BLOCK_HTTP -> confirms both deny lines and the trailing permit ipv6 any any
!---   show run | section interface GigabitEthernet0/1 -> confirms "ipv6 traffic-filter BLOCK_HTTP in"
!---   PC1 browser -> http(s)://2001:db8:1:30::30 -> succeeds (PC1 is on 2001:db8:1:10::/64, not filtered)
!---   PC2 browser -> http(s)://2001:db8:1:30::30 -> blocked (PC2 is on 2001:db8:1:11::/64, the filtered network)
!---   PC2 -> ping 2001:db8:1:30::30              -> still succeeds (ICMP isn't matched by this ACL)
!--- Note: the source note in the lab's own Instructions labels Part 2 Step 1 as running on "R1" —
!--- that's a copy-paste artifact in the documentation only; the actual commands and the lab's own Answer
!--- script correctly target R3 for BLOCK_ICMP (see the separate R3 script).
! ==============================================================

! ==============================================================
!--- 8.7.4 Packet Tracer - Configure IPv6 ACLs
!--- ANSWER SCRIPT FOR ROUTER R3
!--- Usage: copy this whole file and paste it into the R3 terminal (start at the R3> prompt). Every line beginning with "!" is a comment; IOS ignores it, so pasting a comment by accident is harmless.
! ==============================================================

enable
configure terminal

! --------------------------------------------------------------
!--- Part 1: Configure, Apply, and Verify the BLOCK_ICMP IPv6 ACL.
! --------------------------------------------------------------

!--- Begin the named IPv6 ACL.
ipv6 access-list BLOCK_ICMP

!--- Block all ICMPv6 traffic, from any source to any destination — mitigates the DDoS ping flood against Server3.
 deny icmp any any

!--- Permit everything else, so non-ICMP traffic (like PC1's HTTP/HTTPS access to Server3) is unaffected.
 permit ipv6 any any
 exit

! --------------------------------------------------------------
!--- Part 2: Apply the ACL to the Correct Interface.
! --------------------------------------------------------------

!--- Apply outbound on G0/0 — the interface facing Server3, closest to the destination. Filtering here
!--- catches ICMP from any source and stays effective even if the topology upstream changes later.
interface gigabitethernet 0/0
 ipv6 traffic-filter BLOCK_ICMP out
 exit

end

! --------------------------------------------------------------
!--- Save the configuration to NVRAM. (Press Enter when prompted for the destination filename.)
! --------------------------------------------------------------
copy running-config startup-config


! ==============================================================
!--- Verification:
!---   show ipv6 access-list BLOCK_ICMP -> confirms "deny icmp any any" and the trailing permit ipv6 any any
!---   show run | section interface GigabitEthernet0/0 -> confirms "ipv6 traffic-filter BLOCK_ICMP out"
!---   PC2 -> ping 2001:db8:1:30::30              -> now fails (ICMP blocked outbound toward Server3)
!---   PC1 -> ping 2001:db8:1:30::30              -> now fails (ICMP blocked regardless of source)
!---   PC1 browser -> http(s)://2001:db8:1:30::30 -> still succeeds (this ACL only matches ICMP, not TCP)
!--- Note: applying the filter "out" on the interface closest to Server3 (rather than "in" on every
!--- possible source interface) is what makes it catch ICMP from any source — including PC2, which was
!--- already blocked for HTTP/HTTPS by BLOCK_HTTP on R1, but was still able to ping before this ACL.
! ==============================================================