IPv6 configuration on ASA-firewall

[sincerefrank366]

Compliments.

Please, I need direction for a network that has IPv4 & IPv6 together. On the ASA-firewall, IPv6 access-list permit statement configuration could not enter but, I was able to configure IPv6 addresses on the firewall interfaces with OSPFv3 dynamic routing. no issues with IPv4 my challenge is that access-list statement to permit IPv6 ICMP/TCP pings across the firewall could not be establish. I'm using Packet tracer version 8.2.0.

Many thanks.   

[marce1000]

        - Community group for Packet Tracer project questions

 M.

[jilse-iph]

Seperate access-lists for ipv4 and ipv6 were used in firmware versions up to 8.x (if i remember correctly), and  that versions  are really ancient and shoud not be used in production anymore  ...

Newer firmwares use combined access-lists for ipv4 and ipv6 and do not support  seperate  access-lists  for ipv4  and  ipv6  on the same  interface  anymore.

[sincerefrank366]

Thanks. So, what firmware version should I download?

[Harold Ritter]

Hi @sincerefrank366 ,

What @jilse-iph is referring to is the limitation with the ASA physical and virtual appliance. The situation you are experiencing is specific to Cisco Packet Tracer. Unfortunately, configuring an ipv6 ACL or a combined ipv4 and ipv6 ACL doesn't seem to be currently supported in CPT.

This will definitely work in CML or GNS3 using the ASAv.

Regards,  

[jilse-iph]

it  was ong  ago, thhat  i  used pacettracer  to simulate networks.  i  did not  remebe   about te  qualit of  ipv6  support  in packettracer ...

[jilse-iph · Accepted solution]

I  think, your packettracer  software  simulates an  ASA with a 9.x  firmware,  so tere are no seperate access-lists for ipv4  and  ipv6  inpacettracer. ou ave to   use acommbinedaccesslistfor ipv4 and ipv6. In  my eyes,  the combined access-ist  iseasiertoandllethan seperate accesslists  for  ipv4 and ipv6.

For  example if you want to alllow ssh via pv4 and via ipv6  ftom anywere, ou may  use

access-list allow-ssh extended permit tcp any4 any4 eq  ssh

access-list allow-ssh extended permit tcp any6 any6 eq ssh

or you may simpl use instead

access-list allow-ssh extended permit tcp any any eq ssh

which combines the 2 above lines. If i remember correctly,  you can  not  upgrade  or  downgrade firmwares on  the simulated  devices  in  packettracer, you   ave  toive  with wat  pacettracer provides (which should be sufficient for  what you hhave  to  ear   for CCNA  exams).

[sincerefrank366 · Accepted solution]

Alright, I now understand. Many thanks for your help and supportive advice, I really appreciate it.

[sincerefrank366]

Thanks Harold, I do appreciate.

[Harold Ritter]

You are very welcome @sincerefrank366 and thanks for the feedback