Thanks for everyone's help on IRC... we have now blocked the IPv6 addresses in the ACL. Good news, now "drops" any candidate that has IPv6 address. Bad news, it still goes ahead and "chooses" a v6 candidate anyway. See the attached log. You can see this behavior if you search for actions on "fdae:f681:faac:a135:c091:fd50:ad03:6802". As an aside, the command "acl fdae:f681:faac:a135:c091:fd50:ad03:6802 lan" returns "false". Same for "acl fdae:f681:faac:a135:c091:fd50:ad03:6802:56850 lan" Thanks, Craig (p.s., look forward to seeing you all in person tomorrow morning) On Fri, Jul 31, 2015 at 7:20 PM, Michael Jerris <mike@jerris.com> wrote:
The issue is its matching the IPv6 address. if you don't have any v6 on the box you can override the default acl for candidates to not match v6 ever