cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
56640
Views
24
Helpful
20
Comments
Phillip Remaker
Cisco Employee
Cisco Employee

Author: Scott Nishimura.

Updated: Abishek Singh June 2015

Updated: Phillip Remaker August 2016 for 9.6(2) DHCP-PD client feature.

IPv6 Feature Support on the Cisco ASA Firewall

ASA supports IPv6 and it can be setup very easily and quickly.  This document focuses on a basic ASA setup for a native IPv6 network.   As you will see, there are very few commands required to have your ASA firewall join an IPv6 ready network.
Here is a quick way to configure up your ASA firewall for IPv6 connectivity.

BASIC CONFIGURATION

Step 1     

In this step we assign a link local address to the interface. There are 2 ways to assign a link local address to the interface

Step 1.1.    

Configure the interface to generate a link local address from its MAC address.

interface GigabitEthernet 0/0
no shutdown
nameif inside
ipv6 enable

When you enter IPv6 enable, a link local address is automatically generated (this is based on your mac address).  

Step 1.2.    

Configure a link local address manually.

interface GigabitEthernet 0/0
no shutdown
nameif inside
ipv6 address <ipv6-address> link-local

Using the above command you can assign a link local address to the interface manually.
You can verify the link local address by executing the “show ipv6 interface” command.

Step 2     

Next we have to assign the global address to the interface. There are 2 ways of doing this.

Step 2.1.    

You can manually assign a global IPv6 address to the interface.

interface GigabitEthernet 0/0
ipv6 address 2001::db8:2:3::1/64

With the IPv6 address command above, you are manually specifying the global IPv6 address for the interface. You can specify more than one IPv6 addresses for the interface using the command.


Step 2.2.    

You can configure the interface to obtain the address automatically using stateless address autoconfiguration.

interface GigabitEthernet 0/0
ipv6 address autoconfig

Enabling stateless autoconfiguration on the interface configures IPv6 addresses based on prefixes received in Router Advertisement messages.


NOTE: There was a defect (CSCuq62164) in the ASA software that caused the ASA to not assign an address if it received a RA message with both the M and A flags set. This has been fixed in 9.3(1) release and hence we recommend this version if you intend to use SLAAC for configuring the address on ASA interfaces.

Step 3     

Verify IPv6 configuration.

Example:

show ipv6 interface

inside is up, line protocol is up
  IPv6 is enabled, link-local address is fe80::e6c7:22ff:fe84:eb2  
  Global unicast address(es):
    2001:db8:2:3::1, subnet is 2001:db8:2:3::/64  
  Joined group address(es):
    ff02::1:ff00:1
    ff02::1:ff84:eb2
    ff02::2
    ff02::1
  ICMP error messages limited to one every 100 milliseconds
  ICMP redirects are enabled
  ND DAD is enabled, number of DAD attempts: 1
  ND reachable time is 30000 milliseconds
  ND advertised reachable time is 0 milliseconds
  ND advertised retransmit interval is 1000 milliseconds
  ND router advertisements are sent every 200 seconds
  ND router advertisements live for 1800 seconds
  Hosts use stateless autoconfig for addresses.

Step 4     (Optional)

Suppress Router Advertisement messages on an interface.

By default, Router Advertisement messages are automatically sent in response to router solicitation messages. You may want to disable these messages on any interface for which you do not want the security appliance to supply the IPv6 prefix (for example, the outside interface).


Enter the following command to suppress Router Advertisement messages on an interface:

ipv6 nd suppress-ra

Neighbor discovery will continue to be operational even though RA suppression has been configured.

Step 5     

Define an IPv6 default route.

ipv6 route outside ::/0 next_hop_ipv6_addr

Using ::/0 is equivalent to “any”.  The IPv6 route command is functionally similar to the IPv4 route.

Step 6     

Define access-lists.

Using the regular access-list command define the access-lists with IPv6 addresses in them so as to permit the required traffic to flow through the ASA.


Example:

access-list test permit tcp any host 2001:db8::203:a0ff:fed6:162d
access-group test in interface outside

The above is permitting traffic to a specific server 2001:db8::203:a0ff:fed6:162d.

SECURING THE FIREWALL

If you plan to configure autoconfig for the IPv6 global address on the ASA, you should limit the amount of router advertisements (RA) to known routers in your network.  This will help prevent the ASA from being auto configured from unknown routers.

access-list outsideACL permit icmp6 host fe80::21e:7bff:fe10:10c any router-advertisement
access-list outsideACL deny icmp6 any any router-advertisement
access-group outsideACL in interface outside
interface GigabitEthernet 0/0
nameif outside
security-level 0
ipv6 address autoconfig
ipv6 enable

The above access-list when applied on the ASA will limit receiving router advertisements (RA) from only the router specified.  All other RAs will be denied.

Configuring ASA to help autoconfigure IPv6 addresses on hosts behind the ASA

The hosts in the network behind the ASA might be configured to autoconfigure their IPv6 address. Dynamic address assignment happens in 2 ways on IPv6 networks. It could either be a stateful address assignment or stateless address assignment.

Stateful dynamic address assignment

For stateful address assignment, a DHCPv6 server needs to be configured on the network that can assign address to hosts upon request. ASA currently does not have the ability to host a DHCPv6 server on its interfaces. But the ASA can act as a DHCPv6 relay agent. In order to enable stateful dynamic address assignment to hosts behind the ASA, the DHCPv6 relay agent needs to be configured on the ASA.


To configure the DHCPv6 relay agent the following configuration is needed:

ipv6 dhcprelay server 2001:db8:c18:6:a8bb:ccff:fe03:2701
ipv6 dhcprelay enable inside

The first command specifies the address of a DHCPv6 server to which the DHCP requests are forwarded. The command also accepts an optional interface name that specifies the output interface for the destination. The second command enables DHCP relay on an interface. When DHCP relay is enabled on an interface, all the DHCP requests coming on that interface get forwarded to the configured DHCP server.

Stateless dynamic address assignment  

In Stateless Autoconfiguration (SLAAC) the client picks up its own address based on the prefix being advertised by the ASA. The prefix is advertised by means of an IPv6 router advertisement. ASA sends out IPv6 router advertisements by default from any interface on which a global IPv6 address is configured. Additionally, a DHCPv6 relay agent can be configured to point to a DHCPv6 server that can advertise a DNS server address and a domain name only.

IPv6 Prefix delegation

ASA added support for a DHCP-PD client in 9.6(2) .This feature is documented at http://www.cisco.com/c/en/us/td/docs/security/asa/asa96/configuration/general/asa-96-general-config/interface-routed-tfw.html#id_23218 under the heading Configure the IPv6 Prefix Delegation Client.

Prior to 9.6(2), ff the network behind the ASA requires to be assigned IPv6 addresses based on the prefix delegated by a delegation router, then we need to place an ASA between the provider edge (PE) router and the IPv6 capable customer premise router. The ASA must be in transparent mode. This way the ASA protects the entire IPv6 network, including the infrastructure router, on the customer premises. All ICMP6 traffic must be permitted on the ASA running in transparent mode.
The following must be configured on the ASA:

 

firewall transparent
interface BVI1
no ip address
ipv6 enable

interface GigabitEthernet0/0
nameif outside
bridge-group 1
security-level 0

interface GigabitEthernet0/1
nameif inside
bridge-group 1
security-level 100

access-list permit_icmp6 extended permit icmp6 any6 any6
access-group permit_icmp6 global

This example uses a link-local IPv6 address on the BVI interface. You can also configure an explicit IPv6 address for in-band management purposes.

 

 

Comments
jchoward
Level 1
Level 1

Can anyone verify if 9.6(2) Prefix Delegation works for what we need?

http://www.cisco.com/c/en/us/td/docs/security/asa/asa-command-reference/I-R/cmdref2/i4.html#pgfId-2046603

http://www.cisco.com/c/en/us/td/docs/security/asa/roadmap/asa_new_features.pdf (Page 7)

Phillip Remaker
Cisco Employee
Cisco Employee

UPDATE. DHCP-PD client support was added in 9.6(2) release. See: http://www.cisco.com/c/en/us/td/docs/security/asa/asa96/configuration/general/asa-96-general-config/interface-routed-tfw.html#id_23218

Phillip Remaker
Cisco Employee
Cisco Employee

It depends on what you need, but it you are attached to a service that provides prefixes by DHCP-PD (like Comcast), it is what you need.

brockrob
Level 1
Level 1

Supposing my ISP provides IPv6 over PPPoE. ASA currently doesn't support that. Any word on whether we should expect/hope for that to be added, or should we look elsewhere?

ronbuchalski
Level 1
Level 1

Hello Phil,

 

I am taking on the project of setting up my ASA 5506-X for IPv6, with TWC/Spectrum as the ISP.  My ASA is currently running ASA 9.8, so it has the DHCP-PD feature.  But I’m not sure that the feature works, as described in the documentation, when the inside IPV6 interface is a BVI.  I have the seven inside switch ports on the ASA set up in a single bridge-group, and do all the routing via a BVI.  This works fine for IPv4.  But for IPv6, addressing becomes an issue.

 

BTW, the bridge group makes for an interesting IPv6 configuration.  The BVI interface will hold the IPv6 global address, and the switch port interface(s) in the bridge group will hold the IPv6 link-local address(es), with a different one on each switch port.

 

In any case, I have some questions to you regarding the IPv6 addressing, based on my experiences using the ASA Configuration Guide to set up IPv6 and Prefix Delegation (link below):

 

Configure IPv6 Addressing

 

1) My experience with using DHCP-PD indicates that my ISP (Spectrum) provides a /128 address to the outside interface of the firewall, which is NOT part of any prefix provided via DHCP-PD.  Therefor, the PD prefix(es) are to be used strictly behind the firewall, on the inside interfaces.  This seems to coincide with the diagram in the documentation, in the section titled ‘IPv6 Prefix Delegation /64 Subnet Example’, although it shows the outside interface having a /64 address as well as a /60 from the PD client.  Is this a correct understanding of the DHCP PD process?

 

2) For some reason, the IPv6 global address on the BVI cannot be configured using the <PD-Name> ::1:0:0:0:1/64 (or similar).  It will only accept an address if I manually insert the prefix assigned via the PD client response.  This is a problem because, after a reboot, the provider changes the assigned prefix, so I need to manually change the prefix on the BVI in order to get IPv6 working again.  If the address could be defined as <PD-Name>::1:0:0:0:1/64, then it would be automatically updated.  Is this addressed in a newer version of ASA OS?

 

3) The DHCP PD Hint request doesn’t seem to work reliably with Spectrum.  I tried requesting a ::/62 or ::/60, and it gave me a /64.  But then, after a reboot, it gave me a /56!  In reality, if the DHCPV6 server assigns a public IP address to the ASA outside address and provides me with a separate prefix to use internally, I don’t need anything more than a /64, since I’m only creating a single inside subnet.  So, ::/64 Hint is fine.

 

4) I cannot find a way for the ASA (via the BVI or switch port interfaces) to tell the autoconfig hosts to use EUI-64 addressing.  There is a command to enforce EUI-64 (which is a global command, to set it per switch port and for the inside (BVI) interface), but it doesn’t force the hosts to autoconfig a EUI-64 address, so when they create an IPV6 address with a random host address, it fails the EUI-64 enforcement, and they cannot connect to the network!  What am I missing?  Perhaps the IPV6 Neighbor Discovery configuration is missing something?

 

5) My ASA seems to be getting a default IPv6 route by using the interface command ‘ipv6 address DHCP default’ on the outside interface.  So, why would I also need to configure a static default route, as is described in your Quick Start Guide?

 

Thanks in advance for responding to these questions.  I imagine that others reading your guide will have similar questions or issues.

 

-rb

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Innovations in Cisco Full Stack Observability - A new webinar from Cisco