module Cisco-IOS-XR-um-ipv6-access-list-cfg {

    yang-version 1;

    namespace
      "http://cisco.com/ns/yang/Cisco-IOS-XR-um-ipv6-access-list-cfg";

    prefix um-ipv6-acl-cfg;

    import cisco-semver {
      prefix semver;
    }
    import ietf-inet-types {
      prefix inet;
    }
    import Cisco-IOS-XR-um-access-list-datatypes {
      prefix um-acl-types;
    }
    import Cisco-IOS-XR-types {
      prefix xr2;
    }

    organization "Cisco Systems, Inc.";

    contact
      "
     Cisco Systems, Inc.
     Customer Service
     
     Postal: 170 W Tasman Drive
     San Jose, CA 95134
     
     Tel: +1 1800 553-NETS
     
     E-mail: cs-yang@cisco.com
    ";

    description
      "
     This module contains a collection of IOS-XR YANG model derived from CLI.
     
     Copyright (c) 2019-2021 by Cisco Systems, Inc.
     All rights reserved.
    ";

    revision "2021-01-12" {
      description
        "Added udf support
       2020-12-03
         Limit length of remark string";
    }

    revision "2019-06-10" {
      description
        "Establish semantic version baseline.";
    }

    revision "2019-04-01" {
      description "Initial version";
    }

    semver:module-version "2.0.0";
    semver:module-version "1.0.0";

    feature ipv6_acl_object_groups_supported {
      description "Port object group";
    }

    feature ipv6_acl_counter_supported {
      description
        "Counter for access-list entry";
    }

    feature ipv6_acl_protocol_range_implemented {
      description
        "Range of protocol numbers";
    }

    feature ipv6_acl_abf_implemented {
      description
        "Forward to specified nexthop on match against access-list entry";
    }

    feature ipv6_acl_abf_track_implemented {
      description
        "Match a specific TRACK Name";
    }

    feature ipv6_acl_rollback_permit_supported {
      description "Rollback of access-list";
    }

    feature IP_ACL_TCP_URG_FLAG_IMPLEMENTED {
      description "Match on URG bit";
    }

    feature IP_ACL_TCP_FLEXFLAGS_IMPLEMENTED {
      description
        "Match all the options specified for TCP flags";
    }

    feature ipv6_acl_pktlen_implemented {
      description "Check packet length";
    }

    feature ipv6_acl_is_udf_supported {
      description "Set User Defined Fields";
    }

    feature ipv6_acl_capture_implemented {
      description "Capture matched packet";
    }

    feature ipv6_acl_is_set_action_supported {
      description
        "Set action on access-list entry";
    }

    feature ipv6_acl_is_set_qos_group_supported {
      description "Set QoS group";
    }

    feature ipv6_acl_is_set_ttl_supported {
      description "Set ttl value";
    }

    feature ipv6_acl_undetermined_transport_supported {
      description
        "Undetermined transport packet";
    }

    container ipv6 {
      description
        "Configure ipv6 access-list";
      container access-list-options {
        container log-update {
          description
            "Control access lists log updates";
          leaf threshold {
            type uint32 {
              range "1..2147483647";
            }
            description
              "Set access-list logging threshold";
          }

          leaf rate {
            type uint16 {
              range "1..1000";
            }
            description
              "Set access-list logging rate (num. logs per second)";
          }
        }  // container log-update
      }  // container access-list-options

      container access-lists {
        description "Access-lists";
        list access-list {
          key "access-list-name";
          description "Access-list commands";
          leaf access-list-name {
            type string {
              length "1..64";
            }
            description
              "Access list name - maximum 64 characters";
          }

          container sequences {
            description
              "Access list entries";
            list sequence {
              must
                "deny or permit or remark";
              key "sequence-number";
              description
                "access list entry";
              leaf sequence-number {
                type uint32 {
                  range "1..2147483643";
                }
                description
                  "Sequence number for this entry";
              }

              container deny {
                must
                  "(protocol or eq or range) and (source and destination) and (not(log and log-input))";
                presence "Grant type Deny";
                leaf protocol {
                  type um-acl-types:ipv6-protocol;
                  must
                    "not(../eq or ../range/start-protocol or ../range/end-protocol)";
                  description
                    "An IPv6 Protocol";
                }

                leaf eq {
                  type um-acl-types:ipv6-protocol;
                  must
                    "not(../protocol or ../range/start-protocol or ../range/end-protocol)";
                  description
                    "Match only packets with exact protocol numbers";
                }

                container range {
                  if-feature ipv6_acl_protocol_range_implemented;
                  description
                    "Match only packets in the range of protocol numbers";
                  leaf start-protocol {
                    type um-acl-types:ipv6-protocol;
                    must
                      "not(../../protocol or ../../eq) and (../end-protocol)";
                    description
                      "An IPv6 Protocol";
                  }

                  leaf end-protocol {
                    type um-acl-types:ipv6-protocol;
                    must
                      "not(../../protocol or ../../eq) and (../start-protocol)";
                    description
                      "An IPv6 Protocol";
                  }
                }  // container range

                container source {
                  must
                    "address or any or host or net-group";
                  leaf address {
                    type inet:ipv6-address;
                    must
                      "not(../any or ../host or ../net-group) and (../wildcard-mask or ../prefix-length)";
                    description
                      "Source IP address";
                  }

                  leaf wildcard-mask {
                    type inet:ipv6-address-no-zone;
                    must
                      "not(../prefix-length)";
                    description
                      "Source IP address mask. Either wildcard-mask or prefix-length is supported along with address.";
                  }

                  leaf prefix-length {
                    type xr2:Ipv6-prefix-length;
                    must
                      "not(../wildcard-mask)";
                    description
                      "Source IP address prefix length.Either wildcard-mask or prefix-length is supported along with address.";
                  }

                  container any {
                    must
                      "not(../address or ../host or ../net-group)";
                    presence "Any host";
                    description
                      "Any source host";
                  }  // container any

                  leaf host {
                    type inet:ipv6-address;
                    must
                      "not(../address or ../any or ../net-group)";
                    description
                      "A single source host";
                  }

                  leaf net-group {
                    if-feature ipv6_acl_object_groups_supported;
                    type string {
                      length "1..64";
                    }
                    must
                      "not(../address or ../any or ../host)";
                    description
                      "IPv6 source network object group";
                  }

                  container port {
                    when
                      "../../protocol='tcp' or ../../protocol='sctp' or ../../protocol='udp'";
                    description
                      "Match based on a port number";
                    leaf eq {
                      type um-acl-types:ipv6-port-number;
                      must
                        "not(../gt or ../lt or ../neq or ../range/start-value or ../range/end-value)";
                      description
                        "Match only packets on a given port number";
                    }

                    leaf gt {
                      type um-acl-types:ipv6-port-number;
                      must
                        "not(../eq or ../lt or ../neq or ../range/start-value or ../range/end-value)";
                      description
                        "Match only packet with a greater port number";
                    }

                    leaf lt {
                      type um-acl-types:ipv6-port-number;
                      must
                        "not(../eq or ../gt or ../neq or ../range/start-value or ../range/end-value)";
                      description
                        "Match only packets with a lower port number";
                    }

                    leaf neq {
                      type um-acl-types:ipv6-port-number;
                      must
                        "not(../eq or ../gt or ../lt or ../range/start-value or ../range/end-value)";
                      description
                        "Match only packets not on a given port";
                    }

                    container range {
                      description
                        "Match only packets in the range of port numbers";
                      leaf start-value {
                        type um-acl-types:ipv6-port-number;
                        must
                          "not(../../eq or ../../gt or ../../lt or ../../neq) and (../end-value)";
                        description
                          "Port number";
                      }

                      leaf end-value {
                        type um-acl-types:ipv6-port-number;
                        must
                          "not(../../eq or ../../gt or ../../lt or ../../neq) and (../start-value)";
                        description
                          "Port number";
                      }
                    }  // container range
                  }  // container port

                  leaf port-group {
                    when
                      "../../protocol='tcp' or ../../protocol='sctp' or ../../protocol='udp'";
                    if-feature ipv6_acl_object_groups_supported;
                    type string {
                      length "1..64";
                    }
                    description
                      "source port object group";
                  }
                }  // container source

                container destination {
                  must
                    "address or any or host or net-group";
                  leaf address {
                    type inet:ipv6-address;
                    must
                      "not(../any or ../host or ../net-group) and (../wildcard-mask or ../prefix-length)";
                    description
                      "Destination IP address";
                  }

                  leaf wildcard-mask {
                    type inet:ipv6-address-no-zone;
                    must
                      "not(../prefix-length)";
                    description
                      "Destination IP address mask. Either wildcard-mask or prefix-length is supported along with address.";
                  }

                  leaf prefix-length {
                    type xr2:Ipv6-prefix-length;
                    must
                      "not(../wildcard-mask)";
                    description
                      "Destination IP address prefix length.Either wildcard-mask or prefix-length is supported along with address.";
                  }

                  container any {
                    must
                      "not(../address or ../host or ../net-group)";
                    presence "Any host";
                    description
                      "Any destination host";
                  }  // container any

                  leaf host {
                    type inet:ipv6-address;
                    must
                      "not(../address or ../any or ../net-group)";
                    description
                      "A single destination host";
                  }

                  leaf net-group {
                    if-feature ipv6_acl_object_groups_supported;
                    type string {
                      length "1..64";
                    }
                    must
                      "not(../address or ../any or ../host)";
                    description
                      "IPv6 destination network object group";
                  }

                  container port {
                    when
                      "../../protocol='tcp' or ../../protocol='sctp' or ../../protocol='udp'";
                    description
                      "Match based on a port number";
                    leaf eq {
                      type um-acl-types:ipv6-port-number;
                      must
                        "not(../gt or ../lt or ../neq or ../range/start-value or ../range/end-value)";
                      description
                        "Match only packets on a given port number";
                    }

                    leaf gt {
                      type um-acl-types:ipv6-port-number;
                      must
                        "not(../eq or ../lt or ../neq or ../range/start-value or ../range/end-value)";
                      description
                        "Match only packet with a greater port number";
                    }

                    leaf lt {
                      type um-acl-types:ipv6-port-number;
                      must
                        "not(../eq or ../gt or ../neq or ../range/start-value or ../range/end-value)";
                      description
                        "Match only packets with a lower port number";
                    }

                    leaf neq {
                      type um-acl-types:ipv6-port-number;
                      must
                        "not(../eq or ../gt or ../lt or ../range/start-value or ../range/end-value)";
                      description
                        "Match only packets not on a given port";
                    }

                    container range {
                      description
                        "Match only packets in the range of port numbers";
                      leaf start-value {
                        type um-acl-types:ipv6-port-number;
                        must
                          "not(../../eq or ../../gt or ../../lt or ../../neq) and (../end-value)";
                        description
                          "Port number";
                      }

                      leaf end-value {
                        type um-acl-types:ipv6-port-number;
                        must
                          "not(../../eq or ../../gt or ../../lt or ../../neq) and (../start-value)";
                        description
                          "Port number";
                      }
                    }  // container range
                  }  // container port

                  leaf port-group {
                    when
                      "../../protocol='tcp' or ../../protocol='sctp' or ../../protocol='udp'";
                    if-feature ipv6_acl_object_groups_supported;
                    type string {
                      length "1..64";
                    }
                    description
                      "destination port object group";
                  }
                }  // container destination

                container tcp-flags {
                  container match-all {
                    if-feature IP_ACL_TCP_FLEXFLAGS_IMPLEMENTED;
                    must "not(../match-any)";
                    presence
                      "indicates match-all is configured";
                    description
                      "Match all the options specified for TCP flags";
                    leaf tcp-bits {
                      type string {
                        pattern
                          "((\\+|\\-)(fin|syn|rst|psh|ack|urg)[ ]{0,1})+";
                      }
                      description
                        "TCP bits to match with set(+) or not set(-) indication";
                    }
                  }  // container match-all

                  container match-any {
                    if-feature IP_ACL_TCP_FLEXFLAGS_IMPLEMENTED;
                    must "not(../match-all)";
                    presence
                      "indicates match-any is configured";
                    description
                      "Match atleast one of the options specified for TCP flags";
                    leaf tcp-bits {
                      type string {
                        pattern
                          "((\\+|\\-)(fin|syn|rst|psh|ack|urg)[ ]{0,1})+";
                      }
                      description
                        "TCP bits to match with set(+) or not set(-) indication";
                    }
                  }  // container match-any

                  leaf tcp-bits {
                    type um-acl-types:tcp-bits-type;
                    must
                      "not(../match-all) and not(../match-any)";
                    description
                      "TCP bits to match";
                  }
                }  // container tcp-flags

                container icmp {
                  description
                    "Match on ICMP message";
                  leaf message-type-name {
                    type um-acl-types:ipv6-icmp-message-type;
                    must
                      "not(../message-type or ../message-code)";
                    description
                      "ICMP message type";
                  }

                  leaf message-type {
                    type uint8 {
                      range "0..255";
                    }
                    must
                      "not(../message-type-name)";
                    description
                      "ICMP message type";
                  }

                  leaf message-code {
                    type uint8 {
                      range "0..255";
                    }
                    must
                      "not(../message-type-name)";
                    description
                      "ICMP message code";
                  }
                }  // container icmp

                container undetermined-transport {
                  if-feature ipv6_acl_undetermined_transport_supported;
                  presence
                    "Undetermined transport packet (L4 protocol cannot be read)";
                  description
                    "Undetermined transport packet (L4 protocol cannot be read)";
                }  // container undetermined-transport

                leaf headers {
                  type um-acl-types:header-bits-type;
                  description
                    "Match based on headers";
                }

                container dscp {
                  description
                    "Match packets with given DSCP value(s)";
                  leaf dscp-value {
                    type um-acl-types:dscp-value;
                    must
                      "not(../eq or ../gt or ../lt or ../neq or ../range/start-value or ../range/end-value)";
                  }

                  leaf eq {
                    type um-acl-types:dscp-value;
                    must
                      "not(../dscp-value or ../gt or ../lt or ../neq or ../range/start-value or ../range/end-value)";
                    description
                      "Match only packets on a given DSCP value";
                  }

                  leaf gt {
                    type um-acl-types:dscp-value;
                    must
                      "not(../dscp-value or ../eq or ../lt or ../neq or ../range/start-value or ../range/end-value)";
                    description
                      "Match only packet with a greater DSCP value";
                  }

                  leaf lt {
                    type um-acl-types:dscp-value;
                    must
                      "not(../dscp-value or ../eq or ../gt or ../neq or ../range/start-value or ../range/end-value)";
                    description
                      "Match only packets with a lower DSCP value";
                  }

                  leaf neq {
                    type um-acl-types:dscp-value;
                    must
                      "not(../dscp-value or ../eq or ../gt or ../lt or ../range/start-value or ../range/end-value)";
                    description
                      "Match only packets not on a given DSCP value";
                  }

                  container range {
                    description
                      "Match only packets in the range of DSCP values";
                    leaf start-value {
                      type um-acl-types:dscp-value;
                      must
                        "not(../../dscp-value or ../../eq or ../../gt or ../../lt or ../../neq) and (../end-value)";
                      description
                        "DSCP value";
                    }

                    leaf end-value {
                      type um-acl-types:dscp-value;
                      must
                        "not(../../dscp-value or ../../eq or ../../gt or ../../lt or ../../neq) and (../start-value)";
                      description
                        "DSCP value";
                    }
                  }  // container range
                }  // container dscp

                leaf precedence {
                  type um-acl-types:precedence-value;
                  description
                    "Match packets with given precedence";
                }

                container packet-length {
                  if-feature ipv6_acl_pktlen_implemented;
                  description
                    "Check packet length";
                  leaf eq {
                    type uint16 {
                      range "0..65535";
                    }
                    must
                      "not(../gt or ../lt or ../neq or ../range/start-value or ../range/end-value)";
                    description
                      "Match only packets with a given value";
                  }

                  leaf gt {
                    type uint16 {
                      range "0..65535";
                    }
                    must
                      "not(../eq or ../lt or ../neq or ../range/start-value or ../range/end-value)";
                    description
                      "Match only packet with a greater value";
                  }

                  leaf lt {
                    type uint16 {
                      range "0..65535";
                    }
                    must
                      "not(../eq or ../gt or ../neq or ../range/start-value or ../range/end-value)";
                    description
                      "Match only packets with a lower value";
                  }

                  leaf neq {
                    type uint16 {
                      range "0..65535";
                    }
                    must
                      "not(../eq or ../gt or ../lt or ../range/start-value or ../range/end-value)";
                    description
                      "Match only packets not on a given value";
                  }

                  container range {
                    description
                      "Match only packets in the range of value";
                    leaf start-value {
                      type uint16 {
                        range "0..65535";
                      }
                      must
                        "not(../../eq or ../../gt or ../../lt or ../../neq) and (../end-value)";
                      description
                        "Packet length start";
                    }

                    leaf end-value {
                      type uint16 {
                        range "0..65535";
                      }
                      must
                        "not(../../eq or ../../gt or ../../lt or ../../neq) and (../start-value)";
                      description
                        "Packet length end";
                    }
                  }  // container range
                }  // container packet-length

                container ttl {
                  description
                    "match against ttl";
                  leaf eq {
                    type uint8 {
                      range "0..255";
                    }
                    must
                      "not(../gt or ../lt or ../neq or ../range/start-value or ../range/end-value)";
                    description
                      "Match only packets with a given value";
                  }

                  leaf gt {
                    type uint8 {
                      range "0..255";
                    }
                    must
                      "not(../eq or ../lt or ../neq or ../range/start-value or ../range/end-value)";
                    description
                      "Match only packet with a greater value";
                  }

                  leaf lt {
                    type uint8 {
                      range "0..255";
                    }
                    must
                      "not(../eq or ../gt or ../neq or ../range/start-value or ../range/end-value)";
                    description
                      "Match only packets with a lower value";
                  }

                  leaf neq {
                    type uint8 {
                      range "0..255";
                    }
                    must
                      "not(../eq or ../gt or ../lt or ../range/start-value or ../range/end-value)";
                    description
                      "Match only packets not on a given value";
                  }

                  container range {
                    description
                      "Match only packets in the range of value";
                    leaf start-value {
                      type uint8 {
                        range "0..255";
                      }
                      must
                        "not(../../eq or ../../gt or ../../lt or ../../neq) and (../end-value)";
                      description
                        "ttl range lower value";
                    }

                    leaf end-value {
                      type uint8 {
                        range "0..255";
                      }
                      must
                        "not(../../eq or ../../gt or ../../lt or ../../neq) and (../start-value)";
                      description
                        "ttl range higher value";
                    }
                  }  // container range
                }  // container ttl

                list udf {
                  if-feature ipv6_acl_is_udf_supported;
                  key "udf-name";
                  max-elements 8;
                  description
                    "Set User Defined Fields on this entry";
                  leaf udf-name {
                    type string {
                      length "1..16";
                    }
                    description "UDF name";
                  }

                  leaf udf-value {
                    type xr2:Hex-integer;
                    description "UDF value";
                  }

                  leaf udf-mask {
                    type xr2:Hex-integer;
                    description "UDF mask";
                  }
                }  // list udf

                container capture {
                  if-feature ipv6_acl_capture_implemented;
                  presence
                    "Capture matched packet";
                  description
                    "Capture matched packet";
                }  // container capture

                leaf counter {
                  if-feature ipv6_acl_counter_supported;
                  type string {
                    length "1..64";
                  }
                  description
                    "counter for this ACE";
                }

                container log {
                  presence
                    "Log matches against this entry";
                  description
                    "Log matches against this entry";
                }  // container log

                container log-input {
                  presence
                    "Log matches against this entry, including input interface";
                  description
                    "Log matches against this entry, including input interface";
                }  // container log-input

                container set {
                  if-feature ipv6_acl_is_set_action_supported;
                  description
                    "Set action on this entry";
                  leaf qos-group {
                    if-feature ipv6_acl_is_set_qos_group_supported;
                    type uint16 {
                      range "0..512";
                    }
                    description
                      "qos-group number";
                  }

                  leaf ttl {
                    if-feature ipv6_acl_is_set_ttl_supported;
                    type uint8 {
                      range "0..255";
                    }
                    description
                      "Set ttl value";
                  }
                }  // container set

                container icmp-off {
                  presence
                    "Do not generate the ICMP message";
                  description
                    "Do not generate the ICMP message";
                }  // container icmp-off
              }  // container deny

              container permit {
                must
                  "(protocol or eq or range) and (source and destination) and (not(log and log-input))";
                presence "Grant type Permit";
                leaf protocol {
                  type um-acl-types:ipv6-protocol;
                  must
                    "not(../eq or ../range/start-protocol or ../range/end-protocol)";
                  description
                    "An IPv6 Protocol";
                }

                leaf eq {
                  type um-acl-types:ipv6-protocol;
                  must
                    "not(../protocol or ../range/start-protocol or ../range/end-protocol)";
                  description
                    "Match only packets with exact protocol numbers";
                }

                container range {
                  if-feature ipv6_acl_protocol_range_implemented;
                  description
                    "Match only packets in the range of protocol numbers";
                  leaf start-protocol {
                    type um-acl-types:ipv6-protocol;
                    must
                      "not(../../protocol or ../../eq) and (../end-protocol)";
                    description
                      "An IPv6 Protocol";
                  }

                  leaf end-protocol {
                    type um-acl-types:ipv6-protocol;
                    must
                      "not(../../protocol or ../../eq) and (../start-protocol)";
                    description
                      "An IPv6 Protocol";
                  }
                }  // container range

                container source {
                  must
                    "address or any or host or net-group";
                  leaf address {
                    type inet:ipv6-address;
                    must
                      "not(../any or ../host or ../net-group) and (../wildcard-mask or ../prefix-length)";
                    description
                      "Source IP address";
                  }

                  leaf wildcard-mask {
                    type inet:ipv6-address-no-zone;
                    must
                      "not(../prefix-length)";
                    description
                      "Source IP address mask. Either wildcard-mask or prefix-length is supported along with address.";
                  }

                  leaf prefix-length {
                    type xr2:Ipv6-prefix-length;
                    must
                      "not(../wildcard-mask)";
                    description
                      "Source IP address prefix length.Either wildcard-mask or prefix-length is supported along with address.";
                  }

                  container any {
                    must
                      "not(../address or ../host or ../net-group)";
                    presence "Any host";
                    description
                      "Any source host";
                  }  // container any

                  leaf host {
                    type inet:ipv6-address;
                    must
                      "not(../address or ../any or ../net-group)";
                    description
                      "A single source host";
                  }

                  leaf net-group {
                    if-feature ipv6_acl_object_groups_supported;
                    type string {
                      length "1..64";
                    }
                    must
                      "not(../address or ../any or ../host)";
                    description
                      "IPv6 source network object group";
                  }

                  container port {
                    when
                      "../../protocol='tcp' or ../../protocol='sctp' or ../../protocol='udp'";
                    description
                      "Match based on a port number";
                    leaf eq {
                      type um-acl-types:ipv6-port-number;
                      must
                        "not(../gt or ../lt or ../neq or ../range/start-value or ../range/end-value)";
                      description
                        "Match only packets on a given port number";
                    }

                    leaf gt {
                      type um-acl-types:ipv6-port-number;
                      must
                        "not(../eq or ../lt or ../neq or ../range/start-value or ../range/end-value)";
                      description
                        "Match only packet with a greater port number";
                    }

                    leaf lt {
                      type um-acl-types:ipv6-port-number;
                      must
                        "not(../eq or ../gt or ../neq or ../range/start-value or ../range/end-value)";
                      description
                        "Match only packets with a lower port number";
                    }

                    leaf neq {
                      type um-acl-types:ipv6-port-number;
                      must
                        "not(../eq or ../gt or ../lt or ../range/start-value or ../range/end-value)";
                      description
                        "Match only packets not on a given port";
                    }

                    container range {
                      description
                        "Match only packets in the range of port numbers";
                      leaf start-value {
                        type um-acl-types:ipv6-port-number;
                        must
                          "not(../../eq or ../../gt or ../../lt or ../../neq) and (../end-value)";
                        description
                          "Port number";
                      }

                      leaf end-value {
                        type um-acl-types:ipv6-port-number;
                        must
                          "not(../../eq or ../../gt or ../../lt or ../../neq) and (../start-value)";
                        description
                          "Port number";
                      }
                    }  // container range
                  }  // container port

                  leaf port-group {
                    when
                      "../../protocol='tcp' or ../../protocol='sctp' or ../../protocol='udp'";
                    if-feature ipv6_acl_object_groups_supported;
                    type string {
                      length "1..64";
                    }
                    description
                      "source port object group";
                  }
                }  // container source

                container destination {
                  must
                    "address or any or host or net-group";
                  leaf address {
                    type inet:ipv6-address;
                    must
                      "not(../any or ../host or ../net-group) and (../wildcard-mask or ../prefix-length)";
                    description
                      "Destination IP address";
                  }

                  leaf wildcard-mask {
                    type inet:ipv6-address-no-zone;
                    must
                      "not(../prefix-length)";
                    description
                      "Destination IP address mask. Either wildcard-mask or prefix-length is supported along with address.";
                  }

                  leaf prefix-length {
                    type xr2:Ipv6-prefix-length;
                    must
                      "not(../wildcard-mask)";
                    description
                      "Destination IP address prefix length.Either wildcard-mask or prefix-length is supported along with address.";
                  }

                  container any {
                    must
                      "not(../address or ../host or ../net-group)";
                    presence "Any host";
                    description
                      "Any destination host";
                  }  // container any

                  leaf host {
                    type inet:ipv6-address;
                    must
                      "not(../address or ../any or ../net-group)";
                    description
                      "A single destination host";
                  }

                  leaf net-group {
                    if-feature ipv6_acl_object_groups_supported;
                    type string {
                      length "1..64";
                    }
                    must
                      "not(../address or ../any or ../host)";
                    description
                      "IPv6 destination network object group";
                  }

                  container port {
                    when
                      "../../protocol='tcp' or ../../protocol='sctp' or ../../protocol='udp'";
                    description
                      "Match based on a port number";
                    leaf eq {
                      type um-acl-types:ipv6-port-number;
                      must
                        "not(../gt or ../lt or ../neq or ../range/start-value or ../range/end-value)";
                      description
                        "Match only packets on a given port number";
                    }

                    leaf gt {
                      type um-acl-types:ipv6-port-number;
                      must
                        "not(../eq or ../lt or ../neq or ../range/start-value or ../range/end-value)";
                      description
                        "Match only packet with a greater port number";
                    }

                    leaf lt {
                      type um-acl-types:ipv6-port-number;
                      must
                        "not(../eq or ../gt or ../neq or ../range/start-value or ../range/end-value)";
                      description
                        "Match only packets with a lower port number";
                    }

                    leaf neq {
                      type um-acl-types:ipv6-port-number;
                      must
                        "not(../eq or ../gt or ../lt or ../range/start-value or ../range/end-value)";
                      description
                        "Match only packets not on a given port";
                    }

                    container range {
                      description
                        "Match only packets in the range of port numbers";
                      leaf start-value {
                        type um-acl-types:ipv6-port-number;
                        must
                          "not(../../eq or ../../gt or ../../lt or ../../neq) and (../end-value)";
                        description
                          "Port number";
                      }

                      leaf end-value {
                        type um-acl-types:ipv6-port-number;
                        must
                          "not(../../eq or ../../gt or ../../lt or ../../neq) and (../start-value)";
                        description
                          "Port number";
                      }
                    }  // container range
                  }  // container port

                  leaf port-group {
                    when
                      "../../protocol='tcp' or ../../protocol='sctp' or ../../protocol='udp'";
                    if-feature ipv6_acl_object_groups_supported;
                    type string {
                      length "1..64";
                    }
                    description
                      "destination port object group";
                  }
                }  // container destination

                container tcp-flags {
                  container match-all {
                    if-feature IP_ACL_TCP_FLEXFLAGS_IMPLEMENTED;
                    must "not(../match-any)";
                    presence
                      "indicates match-all is configured";
                    description
                      "Match all the options specified for TCP flags";
                    leaf tcp-bits {
                      type string {
                        pattern
                          "((\\+|\\-)(fin|syn|rst|psh|ack|urg)[ ]{0,1})+";
                      }
                      description
                        "TCP bits to match with set(+) or not set(-) indication";
                    }
                  }  // container match-all

                  container match-any {
                    if-feature IP_ACL_TCP_FLEXFLAGS_IMPLEMENTED;
                    must "not(../match-all)";
                    presence
                      "indicates match-any is configured";
                    description
                      "Match atleast one of the options specified for TCP flags";
                    leaf tcp-bits {
                      type string {
                        pattern
                          "((\\+|\\-)(fin|syn|rst|psh|ack|urg)[ ]{0,1})+";
                      }
                      description
                        "TCP bits to match with set(+) or not set(-) indication";
                    }
                  }  // container match-any

                  leaf tcp-bits {
                    type um-acl-types:tcp-bits-type;
                    must
                      "not(../match-all) and not(../match-any)";
                    description
                      "TCP bits to match";
                  }
                }  // container tcp-flags

                container icmp {
                  description
                    "Match on ICMP message";
                  leaf message-type-name {
                    type um-acl-types:ipv6-icmp-message-type;
                    must
                      "not(../message-type or ../message-code)";
                    description
                      "ICMP message type";
                  }

                  leaf message-type {
                    type uint8 {
                      range "0..255";
                    }
                    must
                      "not(../message-type-name)";
                    description
                      "ICMP message type";
                  }

                  leaf message-code {
                    type uint8 {
                      range "0..255";
                    }
                    must
                      "not(../message-type-name)";
                    description
                      "ICMP message code";
                  }
                }  // container icmp

                container undetermined-transport {
                  if-feature ipv6_acl_undetermined_transport_supported;
                  presence
                    "Undetermined transport packet (L4 protocol cannot be read)";
                  description
                    "Undetermined transport packet (L4 protocol cannot be read)";
                }  // container undetermined-transport

                leaf headers {
                  type um-acl-types:header-bits-type;
                  description
                    "Match based on headers";
                }

                container dscp {
                  description
                    "Match packets with given DSCP value(s)";
                  leaf dscp-value {
                    type um-acl-types:dscp-value;
                    must
                      "not(../eq or ../gt or ../lt or ../neq or ../range/start-value or ../range/end-value)";
                  }

                  leaf eq {
                    type um-acl-types:dscp-value;
                    must
                      "not(../dscp-value or ../gt or ../lt or ../neq or ../range/start-value or ../range/end-value)";
                    description
                      "Match only packets on a given DSCP value";
                  }

                  leaf gt {
                    type um-acl-types:dscp-value;
                    must
                      "not(../dscp-value or ../eq or ../lt or ../neq or ../range/start-value or ../range/end-value)";
                    description
                      "Match only packet with a greater DSCP value";
                  }

                  leaf lt {
                    type um-acl-types:dscp-value;
                    must
                      "not(../dscp-value or ../eq or ../gt or ../neq or ../range/start-value or ../range/end-value)";
                    description
                      "Match only packets with a lower DSCP value";
                  }

                  leaf neq {
                    type um-acl-types:dscp-value;
                    must
                      "not(../dscp-value or ../eq or ../gt or ../lt or ../range/start-value or ../range/end-value)";
                    description
                      "Match only packets not on a given DSCP value";
                  }

                  container range {
                    description
                      "Match only packets in the range of DSCP values";
                    leaf start-value {
                      type um-acl-types:dscp-value;
                      must
                        "not(../../dscp-value or ../../eq or ../../gt or ../../lt or ../../neq) and (../end-value)";
                      description
                        "DSCP value";
                    }

                    leaf end-value {
                      type um-acl-types:dscp-value;
                      must
                        "not(../../dscp-value or ../../eq or ../../gt or ../../lt or ../../neq) and (../start-value)";
                      description
                        "DSCP value";
                    }
                  }  // container range
                }  // container dscp

                leaf precedence {
                  type um-acl-types:precedence-value;
                  description
                    "Match packets with given precedence";
                }

                container packet-length {
                  if-feature ipv6_acl_pktlen_implemented;
                  description
                    "Check packet length";
                  leaf eq {
                    type uint16 {
                      range "0..65535";
                    }
                    must
                      "not(../gt or ../lt or ../neq or ../range/start-value or ../range/end-value)";
                    description
                      "Match only packets with a given value";
                  }

                  leaf gt {
                    type uint16 {
                      range "0..65535";
                    }
                    must
                      "not(../eq or ../lt or ../neq or ../range/start-value or ../range/end-value)";
                    description
                      "Match only packet with a greater value";
                  }

                  leaf lt {
                    type uint16 {
                      range "0..65535";
                    }
                    must
                      "not(../eq or ../gt or ../neq or ../range/start-value or ../range/end-value)";
                    description
                      "Match only packets with a lower value";
                  }

                  leaf neq {
                    type uint16 {
                      range "0..65535";
                    }
                    must
                      "not(../eq or ../gt or ../lt or ../range/start-value or ../range/end-value)";
                    description
                      "Match only packets not on a given value";
                  }

                  container range {
                    description
                      "Match only packets in the range of value";
                    leaf start-value {
                      type uint16 {
                        range "0..65535";
                      }
                      must
                        "not(../../eq or ../../gt or ../../lt or ../../neq) and (../end-value)";
                      description
                        "Packet length start";
                    }

                    leaf end-value {
                      type uint16 {
                        range "0..65535";
                      }
                      must
                        "not(../../eq or ../../gt or ../../lt or ../../neq) and (../start-value)";
                      description
                        "Packet length end";
                    }
                  }  // container range
                }  // container packet-length

                container ttl {
                  description
                    "match against ttl";
                  leaf eq {
                    type uint8 {
                      range "0..255";
                    }
                    must
                      "not(../gt or ../lt or ../neq or ../range/start-value or ../range/end-value)";
                    description
                      "Match only packets with a given value";
                  }

                  leaf gt {
                    type uint8 {
                      range "0..255";
                    }
                    must
                      "not(../eq or ../lt or ../neq or ../range/start-value or ../range/end-value)";
                    description
                      "Match only packet with a greater value";
                  }

                  leaf lt {
                    type uint8 {
                      range "0..255";
                    }
                    must
                      "not(../eq or ../gt or ../neq or ../range/start-value or ../range/end-value)";
                    description
                      "Match only packets with a lower value";
                  }

                  leaf neq {
                    type uint8 {
                      range "0..255";
                    }
                    must
                      "not(../eq or ../gt or ../lt or ../range/start-value or ../range/end-value)";
                    description
                      "Match only packets not on a given value";
                  }

                  container range {
                    description
                      "Match only packets in the range of value";
                    leaf start-value {
                      type uint8 {
                        range "0..255";
                      }
                      must
                        "not(../../eq or ../../gt or ../../lt or ../../neq) and (../end-value)";
                      description
                        "ttl range lower value";
                    }

                    leaf end-value {
                      type uint8 {
                        range "0..255";
                      }
                      must
                        "not(../../eq or ../../gt or ../../lt or ../../neq) and (../start-value)";
                      description
                        "ttl range higher value";
                    }
                  }  // container range
                }  // container ttl

                list udf {
                  if-feature ipv6_acl_is_udf_supported;
                  key "udf-name";
                  max-elements 8;
                  description
                    "Set User Defined Fields on this entry";
                  leaf udf-name {
                    type string {
                      length "1..16";
                    }
                    description "UDF name";
                  }

                  leaf udf-value {
                    type xr2:Hex-integer;
                    description "UDF value";
                  }

                  leaf udf-mask {
                    type xr2:Hex-integer;
                    description "UDF mask";
                  }
                }  // list udf

                container default {
                  presence
                    "Use specified default nexthop on match against this entry";
                  description
                    "Use specified default nexthop on match against this entry";
                }  // container default

                container nexthop1 {
                  if-feature ipv6_acl_abf_implemented;
                  presence
                    "Forward to specified nexthop on match against this entry";
                  description
                    "Forward to specified nexthop on match against this entry";
                  leaf ipv6 {
                    type inet:ipv6-address;
                    description
                      "nexthop1 ipv6 address";
                  }

                  leaf track {
                    if-feature ipv6_acl_abf_track_implemented;
                    type string {
                      length "1..32";
                    }
                    description
                      "specific TRACK Name for this nexthop";
                  }

                  leaf vrf {
                    type string {
                      length "1..32";
                    }
                    description
                      "Specific VRF Name for this nexthop";
                  }
                }  // container nexthop1

                container nexthop2 {
                  must
                    "(../nexthop1/vrf and ../nexthop1/ipv6) or ../nexthop1/vrf or ../nexthop1/ipv6";
                  presence
                    "Forward to specified nexthop on match against this entry";
                  description
                    "Another nexthop";
                  leaf ipv6 {
                    type inet:ipv6-address;
                    description
                      "nexthop2 ipv6 address";
                  }

                  leaf track {
                    if-feature ipv6_acl_abf_track_implemented;
                    type string {
                      length "1..32";
                    }
                    description
                      "specific TRACK Name for this nexthop";
                  }

                  leaf vrf {
                    type string {
                      length "1..32";
                    }
                    description
                      "Specific VRF Name for this nexthop";
                  }
                }  // container nexthop2

                container nexthop3 {
                  must
                    "(../nexthop2/vrf and ../nexthop2/ipv6) or ../nexthop2/vrf or ../nexthop2/ipv6";
                  presence
                    "Forward to specified nexthop on match against this entry";
                  description
                    "Another nexthop";
                  leaf ipv6 {
                    type inet:ipv6-address;
                    description
                      "nexthop3 ipv6 address";
                  }

                  leaf track {
                    if-feature ipv6_acl_abf_track_implemented;
                    type string {
                      length "1..32";
                    }
                    description
                      "specific TRACK Name for this nexthop";
                  }

                  leaf vrf {
                    type string {
                      length "1..32";
                    }
                    description
                      "Specific VRF Name for this nexthop";
                  }
                }  // container nexthop3

                container capture {
                  if-feature ipv6_acl_capture_implemented;
                  presence
                    "Capture matched packet";
                  description
                    "Capture matched packet";
                }  // container capture

                leaf counter {
                  if-feature ipv6_acl_counter_supported;
                  type string {
                    length "1..64";
                  }
                  description
                    "counter for this ACE";
                }

                container log {
                  presence
                    "Log matches against this entry";
                  description
                    "Log matches against this entry";
                }  // container log

                container log-input {
                  presence
                    "Log matches against this entry, including input interface";
                  description
                    "Log matches against this entry, including input interface";
                }  // container log-input

                container set {
                  if-feature ipv6_acl_is_set_action_supported;
                  description
                    "Set action on this entry";
                  leaf qos-group {
                    if-feature ipv6_acl_is_set_qos_group_supported;
                    type uint16 {
                      range "0..512";
                    }
                    description
                      "qos-group number";
                  }

                  leaf ttl {
                    if-feature ipv6_acl_is_set_ttl_supported;
                    type uint8 {
                      range "0..255";
                    }
                    description
                      "Set ttl value";
                  }
                }  // container set
              }  // container permit

              leaf remark {
                type string {
                  length "0..255";
                }
                description
                  "Comment for access list";
              }
            }  // list sequence
          }  // container sequences
        }  // list access-list
      }  // container access-lists
    }  // container ipv6
  }  // module Cisco-IOS-XR-um-ipv6-access-list-cfg