topic Re: Blocking IPv6 on ASA in Network Security

Blocking IPv6 on ASA

vijay4211 — Fri, 26 Jul 2024 10:41:59 GMT

Hi All,

is IPv6 blocked on Cisco ASA by default? we are running version 9.12 currently and have received a request to block an IPv6 address and I am pretty sure we haven't used IPv6 in our environment before. So was wondering if we need to take any action on the same.

Regards,

Vijay

Re: Blocking IPv6 on ASA

MHM Cisco World — Fri, 26 Jul 2024 10:52:05 GMT

Do you have any attack to your VPN service and you want to deny this IP to access ASA?

MHM

Re: Blocking IPv6 on ASA

vijay4211 — Fri, 26 Jul 2024 11:53:14 GMT

Hi MHM,

No, not for this. Actually this is an internet facing firewall and we block malicious IPs coming on our outside interface as provided by our SOC advisories. But this is the first time we have received a request for an IPv6 address.

Re: Blocking IPv6 on ASA

vijay4211 — Sat, 27 Jul 2024 06:49:58 GMT

Anyone has any idea on whether we should be blocking this Ipv6 address through, say an ACL, or will it get blocked by default?

Re: Blocking IPv6 on ASA

tvotna — Mon, 29 Jul 2024 14:29:31 GMT

I believe that in the routed firewall mode ASA drops all IPv6 if IPv6 addresses are not configured on ASA interfaces, simply because its IPv6 routing table is empty in this case. Transparent firewall mode also requires IPv6 address to be configured.

NB. In ASA ACLs "any" means "any4" OR "any6", so if IPv6 addresses are configured on ASA interfaces, it may let IPv6 through "any" depending on your configuration.

HTH

Re: Blocking IPv6 on ASA

MHM Cisco World — Mon, 29 Jul 2024 15:00:11 GMT

defualt behavior of asa is prevent any traffic from low to high secuirty even if you not config ACL and this inlcude both ipv4 and ipv6

But to be sure I run lab yesterday to add ipv6 access-list any any log to OUT of asa but the command is unknown'

Sorry I have limit time these day I will try soon and update you when I sucess

Thanks

MHM