prevents MLD responses     [a] SVI/L3 ACL  [b] L2 port ACL  [c] VLAN map ACL
/ cpu@3kpps
[1] 4500 L3 port           yes             n/a              no
                            60%cpu
[2] 4500 SVI + L2 access   yes             yes              yes
                            60%cpu          0%cpu            0%cpu
[3] 4500 SVI + L2 trunk    yes             yes              yes
                            60%cpu          0%cpu            0%cpu
[4] 6500 L3 port           yes             n/a              n/a
                            20%rp 0%sp
[5] 6500 SVI + L2 access   yes             no               no
                            20%rp 40%sp
[6] 6500 SVI + L3 trunk    yes             no               no
                            20%rp 40%sp



[1] 4500 with L3 port
ipv6 unicast-routing
int g1/48
 no switchport
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 ipv6 address 2001:DB8:4:1::22EF:2/64
 ipv6 nd ra suppress all
 no ipv6 redirects
 no ipv6 unreachables
 no cdp enable
[1.a]
ipv6 access-list v6-denymldquery-in
 deny icmp any host ff02::1 mld-query
 permit ipv6 any any
interface g1/48
 ipv6 traffic-filter v6-denymldquery-in in
[1.c]
do show vlan internal usage
ipv6 access-list match-mld-query
 permit icmp any host ff02::1 mld-query
vlan access-map drop-mld-query
 match ipv6 address match-mld-query
 action drop
vlan filter drop-mld-query vlan-list 1006

[2] 4500 with SVI + access port
ipv6 unicast-routing
vlan 1201
interface g1/48
 switchport access vlan 1201
 switchport mode access
 switchport nonegotiate
 no cdp enable
 spanning-tree portfast
 spanning-tree bpdufilter enable
int vlan 1201
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 ipv6 address 2001:DB8:4:1::22EF:2/64
 ipv6 nd ra suppress all
 no ipv6 redirects
 no ipv6 unreachables
 no shutdown
[2.a]
ipv6 access-list v6-denymldquery-in
 deny icmp any host ff02::1 mld-query
 permit ipv6 any any
interface vlan 1201
 ipv6 traffic-filter v6-denymldquery-in in
[2.b]
ipv6 access-list v6-denymldquery-in
 deny icmp any host ff02::1 mld-query
 permit ipv6 any any
interface g1/48
 ipv6 traffic-filter v6-denymldquery-in in
[2.c]
ipv6 access-list match-mld-query
 permit icmp any host ff02::1 mld-query
vlan access-map drop-mld-query
 match ipv6 address match-mld-query
 action drop
vlan filter drop-mld-query vlan-list 1201


[3] 4500 with SVI + trunk port
ipv6 unicast-routing
vlan 1201
interface g1/48
 switchport trunk allowed vlan 1201
 switchport mode trunk
 switchport nonegotiate
 no cdp enable
 no vtp
 spanning-tree portfast trunk
 spanning-tree bpdufilter enable
int vlan 1201
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 ipv6 address 2001:DB8:4:1::22EF:2/64
 ipv6 nd ra suppress all
 no ipv6 redirects
 no ipv6 unreachables
 no shutdown
[3.a]
ipv6 access-list v6-denymldquery-in
 deny icmp any host ff02::1 mld-query
 permit ipv6 any any
interface vlan 1201
 ipv6 traffic-filter v6-denymldquery-in in
[3.b]
ipv6 access-list v6-denymldquery-in
 deny icmp any host ff02::1 mld-query
 permit ipv6 any any
interface g1/48
 ipv6 traffic-filter v6-denymldquery-in in
[3.c]
ipv6 access-list match-mld-query
 permit icmp any host ff02::1 mld-query
vlan access-map drop-mld-query
 match ipv6 address match-mld-query
 action drop
vlan filter drop-mld-query vlan-list 1201



[4] 6500 with L3 port
ipv6 unicast-routing
int g1/2
 no ip address
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 media-type rj45
 ipv6 address 2001:DB8:4:1::22EF:2/64
 ipv6 nd ra suppress all
 no ipv6 redirects
 no ipv6 unreachables
 no cdp enable
 no shutdown
[4.a]
ipv6 access-list v6-denymldquery-in
 deny icmp any host ff02::1 mld-query
 permit ipv6 any any
interface g1/2
 ipv6 traffic-filter v6-denymldquery-in in



[5] 6500 with SVI + access port
ipv6 unicast-routing
vlan 1201
int g1/2
 switchport
 switchport access vlan 1201
 switchport mode access
 switchport nonegotiate
 media-type rj45
 no cdp enable
 spanning-tree portfast edge
 spanning-tree bpdufilter enable
 no shutdown
int vlan 1201
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 ipv6 address 2001:DB8:4:1::22EF:2/64
 ipv6 nd ra suppress all
 no ipv6 redirects
 no ipv6 unreachables
 no shutdown
[5.a]
ipv6 access-list v6-denymldquery-in
 deny icmp any host ff02::1 mld-query
 permit ipv6 any any
interface vlan 1201
 ipv6 traffic-filter v6-denymldquery-in in
[5.b]
ipv6 access-list v6-denymldquery-in
 deny icmp any host ff02::1 mld-query
 permit ipv6 any any
interface g1/2
 ipv6 traffic-filter v6-denymldquery-in in
[5.c]
ipv6 access-list match-mld-query
 permit icmp any host ff02::1 mld-query
vlan access-map drop-mld-query
 match ipv6 address match-mld-query
 action drop
vlan filter drop-mld-query vlan-list 1201




[6] 6500 with SVI + trunk port
ipv6 unicast-routing
vlan 1201
int g1/2
 switchport
 switchport trunk encapsulation dot1q
 switchport trunk allowed vlan 1201
 switchport mode trunk
 switchport nonegotiate
 media-type rj45
 no cdp enable
 no vtp
 spanning-tree portfast edge trunk
 spanning-tree bpdufilter enable
 no shutdown
int vlan 1201
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 ipv6 address 2001:DB8:4:1::22EF:2/64
 ipv6 nd ra suppress all
 no ipv6 redirects
 no ipv6 unreachables
 no shutdown
[6.a]
ipv6 access-list v6-denymldquery-in
 deny icmp any host ff02::1 mld-query
 permit ipv6 any any
interface vlan 1201
 ipv6 traffic-filter v6-denymldquery-in in
[6.b]
ipv6 access-list v6-denymldquery-in
 deny icmp any host ff02::1 mld-query
 permit ipv6 any any
interface g1/2
 access-group mode prefer port
 ipv6 traffic-filter v6-denymldquery-in in
[6.c]
ipv6 access-list match-mld-query
 permit icmp any host ff02::1 mld-query
vlan access-map drop-mld-query
 match ipv6 address match-mld-query
 action drop
vlan filter drop-mld-query vlan-list 1201
[6.d]
mls qos
ipv6 access-list match-mld-query
 permit icmp any host ff02::1 mld-query
class-map class-mld-query
 match access-group name match-mld-query
policy-map test-copp
 class class-mld-query
  police 32000 2000    conform-action drop exceed-action drop 
control-plane
 service-policy input test-copp