Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a basic firewall set up on an pretty od IOS in form of

IPv6 access list exterior-in6
  evaluate exterior-reflect sequence 1
  permit ipv6 any host [my external address] sequence 10
  permit tcp any host [my internal address] eq 22 sequence 11
  permit icmp any any sequence 800
  permit udp any any range 6881 6889 sequence 900
  permit tcp any any range 6881 6889 sequence 901
  deny ipv6 any any sequence 1000
IPv6 access list exterior-out6
  permit ipv6 [my internal subnet] any reflect exterior-reflect sequence 10

Unfortunately the

evaluate exterior-reflect sequence 1

line seems to get lost after each reboot, leaving my internal network without access. Any ideas?

share|improve this question
up vote 0 down vote accepted

This is a bug in IOS. The access list is saved as

sequence 1 evaluate exterior-reflect

but IOS can only parse

evaluate exterior-reflect sequence 1

It's a bug in the configuration syntax parser. I have tested the following IOS images, and they all have this bug:

  • c7200-advipservicesk9-mz.122-33.SRC3
  • c7200-advipservicesk9-mz.124-24.T4
  • c7200-advipservicesk9-mz.151-3.T1.4
  • c7200-advipservicesk9-mz.151-4.M1

Creating a TAC case...

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.