A sanitation department dual-stacks civic border routers and needs to restrict IPv6 management-plane access similarly to IPv4 ACLs. Which feature family addresses that on IOS?
Select an answer to reveal the explanation.
Short Explanation
IPv6 doesn't borrow the old IPv4 guest list. You need IPv6 traffic filters—IPv6 ACLs—hung on the interfaces that carry the v6 management talk.
Full Explanation
A sanitation department dual-stacking civic border routers and needing to restrict IPv6 management-plane access similarly to IPv4 ACLs must use IPv6 traffic filters (IPv6 ACLs) applied to interfaces to permit or deny IPv6 flows. IPv6 does not reuse IPv4 ACL numbers or match logic as a substitute; IOS provides a separate IPv6 ACL/traffic-filter family that understands IPv6 addresses and next-header semantics. The correct feature family works because dual-stack edges forward IPv6 independently, so management-plane restriction for v6 requires v6-aware filters on the interfaces carrying that traffic. Using IPv4 standard ACLs numbered 1–99 to match IPv6 next-headers without modification fails because those ACLs evaluate IPv4 sources and do not implement IPv6 traffic filtering. Claiming DMVPN NHRP redirect alone replaces IPv6 interface ACLs fails conceptually: NHRP redirect optimizes shortcut paths in DMVPN, it is not an IPv6 management ACL substitute. Relying on MPLS LDP session passwords to filter IPv6 management traffic on PE-CE links fails because LDP authentication protects label distribution sessions, not general IPv6 management-plane flows on civic borders. Exam caveat: applying only IPv4 ACLs on a dual-stack civic edge leaves IPv6 management paths wide open—audit both protocol planes. Operational check: create IPv6 ACLs mirroring the intended management source policy, apply them with ipv6 traffic-filter in the correct direction on the dual-stack interfaces, and verify with IPv6 test access and IPv6 ACL counters while confirming IPv4 policy remains separately enforced.