cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements

808
Views
0
Helpful
1
Replies
mocah
Beginner

IOS ZBF not allowing IPv6

Hello all,

I am trying to configure Zone Based Firewall (IOS 15.2T) on Cisco 881 router for IPv6. Current setup is simple:

Zone:

LAN --> WAN

zone security LAN

zone security WAN

!

class-map type inspect match-any Internet-cmap

match protocol dns

match protocol http

match protocol https

match protocol icmp

match protocol ftp

match protocol pop3

match protocol pop3s

match protocol smtp

!

policy-map type inspect Internet-pmap

class type inspect Internet-cmap

inspect

!

zone-pair security LAN-WAN source LAN destination WAN

service-policy type inspect Internet-pmap

Zone:

WAN--> self deny everything.

Current configuration behaves as expected for IPv4, but blocks all IPv6 traffic. If zone-security is removed from WAN interface IPv6 works normally (connected to Internet). As soon as zone-security is enabled on WAN interface all IPV6 traffic is discarded when connecting to Internet from local LAN.

Error messages on console:

Half-open Sessions source destination tcp SIS_OPENING/TCP_SYNSENT

Are there any specia settings for ZBF which should be turned on for IPv6 protocol?

Thank you and kind regards,

Marko

1 REPLY 1
mocah
Beginner

Problem is with Internet  to Self zone. If  zone Internet to Self  is removed IPv6 works.

FW-6-DROP_PKT: Dropping icmpv6 session [FE80::290:1AFF:xxxx:xxxx]:0 [FE80::221:D8FF:xxxx:xxxx]:0 on zone-pair Internet-to-Self class Internet-to-Self-icmpv6-cmap   with ip ident 0

Which rule would allowed IPv6 traffic from Internet to self zone? I have tried to allowe all icmpv6 traffic but same error appeared. Only if zone-security Internet to Self is removed IPv6 works.

Thank you and kind regards,

Marko

Create
Recognize Your Peers
Content for Community-Ad