How to deny ipv6 echo-reply to directly adjacent router?

[mmanthe]

Scenario: 2 routers (R1 & R2) connected directly (point-to-point) via serial interfaces. Dual stack (IPv4 & IPv6). R1 is mine - I control it. R2 is not mine - I cannot control it or make any configurations on it.

I want to be able to block IPv6 ICMP echo replies from *MY* (R1's) serial interface back to R2's serial interface (e.g. not reply to pings sourced from R2's serial interface). Creating and applying an IPv6 ACL on R1's serial interface does not work - I guess because it only filters/blocks traffic going *through* the interface, not *to* the interface.

How else would I accomplish this?

Thanks!

PS - please ignore the 'logic' of this endeavor - it is purely academic. 

[Seb Rupik · Accepted solution]

Hi there,

Take a look at CoPP. You should be able to take the ACL you have configured and use it to define a class-map. Then create a new policy-map referencing your class map with the action drop, something like:

!
class-map match-all DROP-R2-ICMP
  match access-group <YOUR_ACL>
!
policy-map RTR_COPP
  class DROP-R2-ICMP
    drop
!
control-plane
  service-policy input RTR_COPP
!

cheers,

Seb.

[mmanthe]

Seb

This worked like a charm - thanks! It's a bit of a 'long-way-round', but I can see a lot of ways to utilize this. Thanks so much for your help!

[Harold Ritter]

Hi,

Interface ACLs in general do not normally block locally originated traffic. Have you tried blocking ICMPv6 echo request coming from R2 in an inbound ACL, rather than ICMPv6 echo reply to R2 in an outbound ACL.

Regards,

[mmanthe]

Harold - thanks for the reply. I tried blocking requests and replies (e.g. ingress and egress) - unfortunately, due to the nature of ACLs in general, there never was really any hope for it to work for what I wanted it to do.Fortunately, Seb's solution was able to accomplish this. Given its operation at the control-plane level - it 'sees' the packets before the interface does and can filter on my criteria (albeit 3 layers deep ;-) ).

Thanks!