Configuring IPv6 on an Interface

Beginning with ASA 7.0, firewall interfaces can be configured with an IPv6 address in addition to a traditional IPv4 address. IPv6 addresses are 128 bits long—much longer than a 32-bit IPv4 address! As well, the IPv6 address format is very different and can be written in the following ways:

• In full hexadecimal format, the address is written as eight groups of four hexadecimal digits, with colons separating the groups. For example, 1111:2222:3333:4444:5555:6666:7777:8888 represents a single IPv6 host.

• Leading 0s can be omitted in any group. For example, 1111:0200:0030:0004:5555:6666:7777:8888 can also be written as 1111:200:30:4:5555:6666:7777:8888.

• Because IPv6 addresses are so long and the address space is so large, addresses with many embedded 0s are common. Therefore, you can abbreviate any number of contiguous 0s as a double colon (::), even if the 0s cross a digit group boundary. For example, 1111:0:0:0:0:0:0:8888 could also be written as 1111::8888. This abbreviation can be used only once in an address, however.

• IPv6 addresses can also be shown with a network prefix. This specifies how many most-significant bits are used to represent a network address. This is very similar to IPv4 addresses, where the address and prefix values are separated by a slash (/). For IPv6, this format is also ipv6_address/prefix_length, where the prefix length is a value from 1 to 128 bits.

Each firewall interface can potentially have three different IPv6 addresses configured:

• Link-local address— An address that is unique on a network connection to other devices. This is used only for IPv6 neighbor discovery, address autoconfiguration, and administrative uses. A firewall cannot forward packets that have link-local addresses as the destination. The address format consists of the following components:

- FE80 in the 10 most-significant bits

- 54 bits of 0s

- 64 bits of host addressing in the modified EUI-64 format

• Site-local address— A unique address within the site network that cannot be routed outside the site. The address consists of the following components:

- FEC0 in the 10 most-significant bits

- 38 bits of 0s

- 16 bits of subnet ID addressing

- 64 bits of host addressing

• Global address— A globally unique address that can be routed outside the local link and local network. The address consists of the following components:

- 001 in the 3 most-significant bit positions

- 45 bits of provider addressing (unique to each service provider)

- 16 bits of site or subnet addressing (unique only within the local site network)

- 64 bits of host addressing (48 bits usually come from the MAC address)

After you configure IPv6 addresses and routing information, the firewall can begin to statefully inspect traffic using IPv6. The following inspection engines are equipped to inspect either IP version:

You can follow these steps to configure IPv6 on your firewall:

1. Select a firewall interface:

Firewall(config)# interface hardware-id

The interface is identified by its hardware-id, which is the full interface type and number or an abbreviated version. For example, GigabitEthernet 0, GigabitEthernet0, and gig0 all refer to the same interface.

2. Assign an IPv6 address to an interface.

a. (Optional) Use autoconfiguration to derive interface addresses.

A firewall can use stateless autoconfiguration to derive link-local and global addresses for an interface. Use the following commands to enable autoconfiguration:

Firewall(config-if)# ipv6 address autoconfig Firewall(config-if)# ipv6 enable

The firewall first creates a link-local address for the interface. This can be done without any knowledge of surrounding networks or neighboring devices. The link-local address is formed as follows, building digits from least- to most-significant (right to left):

- The three least-significant octets are the three least-significant octets of the MAC address.

- The three most-significant octets of the MAC address become the three next-most-significant octets of the link-local address.

In addition, the next-to-least-significant bit of the most-significant MAC address byte is set to 1. For example, 0003.47 would become 0203.47.

The most-significant address digits always begin with FE80.

For example, consider the following firewall interface. You can use the show interface command to display the interface's MAC address, which is 0003.4708.ec54. When the autoconfiguration is complete, the IPv6 link-local address can be seen with the show ipv6 interface command. Here, the link-local address has become fe80::203:47ff:fe08:ec54:

Firewall# show interface gigabitethernet 1.2

Interface GigabitEthernet1.2 "inside", is up, line protocol is up VLAN identifier 2

MAC address 0003.4708.ec54, MTU 1500 IP address 192.168.198.1, subnet mask 255.255.255.0 Received 1482892 packets, 81328736 bytes Transmitted 311834 packets, 24639862 bytes Dropped 1060893 packets Firewall#

Firewall# show ipv6 interface inside inside is up, line protocol is up

IPv6 is enabled, link-local address is fe80::203:47ff:fe08:ec54 No global unicast address is configured Joined group address(es): ff02::1 ff02::2

ff02::1:ff08:ec54 [output omitted]

The global interface address has a similar form, but it begins with the prefix learned from a neighboring router. A modified EUI-64 address is used, which includes the ff:fe and MAC address portions.

After a prefix has been learned from router advertisements, you can display the global address with the show ipv6 interface command, as in the following example:

Firewall# show ipv6 interface inside inside is up, line protocol is up

IPv6 is enabled, link-local address is fe80::203:47ff:fe08:ec54 Global unicast address(es):

1999::203:47ff:fe08:ec54, subnet is 1999::/64 [AUTOCONFIG] valid lifetime 2591959 preferred lifetime 604759 Joined group address(es): ff02::1 ff02::2

ff02::1:ff08:ec54 [output omitted]

b. (Optional) Specify a link-local address:

Firewall(config-if)# ipv6 address ipv6 address link-local

You can assign a specific link-local address as ipv6_address if autoconfiguration is not wanted.

c. (Optional) Specify a complete global IPv6 address:

Firewall(config-if)# ipv6 address ipv6 address/prefix length [eui-64]

You can specify the complete global address as ipv6_address. The prefix_length (1 to 128) specifies the number of most-significant address bits reserved for the network address. The global address must be unique within the IPv6 network.

You can also use the eui-64 keyword to let the firewall build a unique modified EUI-64 address format. The ipv6_address value is used for the upper 64 bits. The lower 64 bits of the address are the upper three octets of the interface MAC address, ff:fe, and the lower three MAC address octets.

3. Use IPv6 neighbor discovery to learn about neighboring devices.

A firewall can participate in IPv6 neighbor discovery to learn about other directly connected devices. Neighbor discovery is always enabled. You can follow these steps to adjust the neighbor discovery operation:

a. (Optional) Set the neighbor solicitation interval:

Firewall(config-if)# ipv6 nd ns-interval value

The firewall sends neighbor solicitation messages at the interval value (1000 to 3,600,000 milliseconds [ms]; the default is 1000 ms or 1 second).

b. (Optional) Set the neighbor reachability time:

Firewall(config-if)# ipv6 nd reachable-time value

If the neighboring device becomes unreachable, the firewall can send neighbor solicitation messages in an attempt to get a response. The firewall waits for value milliseconds (0 to 3,600,000; the default is 0) before declaring the neighbor unreachable. A value of 0 means that the firewall advertises an unspecified reachability time to its neighbors and does not measure this time itself.

c. (Optional) Adjust duplicate address detection (DAD):

Firewall(config-if)# ipv6 nd dad attempts value

A firewall attempts to check to see if another device is using its own interface link-local address. If a duplication is detected, no IPv6 data is processed on the interface.

If the link-local address is not duplicated, the firewall checks for a duplicate of its interface global IPv6 address.

The firewall sends value (0 to 600; the default is 1) neighbor solicitation messages to detect a duplicate address. If value is set to 0, no DAD is performed.

If a directly connected IPv6 neighbor cannot be discovered automatically, you can define it as a static entry. Use the following global configuration command to define and locate the neighboring device:

Firewall(config)# ipv6 neighbor ipv6 address if name mac address

The neighbor uses the local data-link address ipv6_address and MAC address mac_address (xxxx.xxxx.xxxx hex format). As well, the neighbor can be found on the firewall interface named if_name (outside, for example).

Suppose a neighboring device connected to the inside interface uses IPv6 local datalink address fe80::206:5bff:fe02:a841 and MAC address 0006.5b02.a841. You could use the following command to define a static neighbor entry:

Firewall(config)# ipv6 neighbor fe80::206:5bff:fe02:a841 inside 0006.5b02.a841

4. Configure IPv6 router advertisements on the interface.

As a Layer 3 IPv6 device, a firewall can participate in router advertisements so that neighboring devices can dynamically learn a default router address. You can follow these steps to configure how the firewall carries out its router advertisement process:

a. (Optional) Stop sending router advertisements:

Firewall(config-if)# ipv6 nd suppress-ra

By default, a firewall acts as an IPv6 router if IPv6 is enabled and the interface has an IPv6 address. The firewall sends periodic router advertisements to neighboring IPv6 devices, announcing itself as a router.

You can use the ipv6 nd suppress-ra command to stop sending router advertisements. In this case, the firewall appears as a regular IPv6 neighbor or node. Neighbor discovery is active even when router advertisements are suppressed.

b. (Optional) Set the router advertisement interval:

Firewall(config-if)# ipv6 nd ra-interval [msec] value

By default, a firewall sends router advertisements out an IPv6 interface every 200 seconds. You can adjust the interval to value (3 to 1800 seconds, or 500 to 1,800,000 ms if the msec keyword is given).

c. (Optional) Adjust the lifetime of router advertisements:

Firewall(config-if)# ipv6 nd ra-lifetime seconds

By default, router advertisements are sent with a valid lifetime of 1800 seconds. Neighboring devices can expect the firewall to be a default router for the duration of the lifetime value.

You can adjust the lifetime to seconds (0 to 9000 seconds). A value of 0 indicates that the firewall should not be considered a default router on the advertising interface.

5. (Optional) Configure IPv6 prefixes to advertise.

By default, a firewall advertises the prefix from any IPv6 address that is configured on an interface. The prefix advertisement can be used by neighboring devices to autoconfigure their interface addresses.

In the commands covered in Steps 5a through 5d, you can use the default keyword to define lifetimes for all prefixes that are advertised. Otherwise, you can specify an IPv6 prefix as ipv6_address/prefix_length. The prefix_length is the number of the most-significant bits used as a network prefix, from 1 to 128.

You can also add the no-autoconfig keyword to advertise that the prefix should not be used for autoconfiguration. By default, any prefix that is advertised is assumed to be "on link," meaning that it is used on the advertising interface. You can add the off-link keyword to specify a prefix that is not configured on the firewall interface.

a. (Optional) Advertise a prefix with default lifetime values:

Firewall(config-if)# ipv6 nd prefix {default | ipv6_address/prefix_length} [no-autoconfig] [off-link]

By default, the prefix is advertised with a valid lifetime of 30 days (2,592,000 seconds) and a preferred lifetime of 7 days (604,800 seconds).

For example, the following command causes the IPv6 prefix 1999::/64 to be advertised with the default values:

Firewall(config)# ipv6 nd prefix 1999::/64

b. (Optional) Advertise a prefix with predefined lifetime values:

Firewall(config-if)# ipv6 nd prefix {default |

ipv6 address/prefix length} valid lifetime preferred lifetime [no-autoconfig] [off-link]

The prefix is advertised with a valid lifetime of valid_lifetime (0 to 4,294,967,295 or infinite seconds). The prefix also is advertised as a preferred prefix lasting preferred_lifetime (0 to 4,294,967,295 or infinite seconds).

To advertise the prefix 1999::/64 with a valid lifetime of 5 days (432,000 seconds) and a preferred lifetime of 1 day (86,400 seconds), you could use the following command:

Firewall(config)# ipv6 nd prefix 1999::/64 432000 86400

c. (Optional) Advertise a prefix with an expiration date:

Firewall(config-if)# ipv6 nd prefix {default |

ipv6 address/prefix length} at valid date time preferred date time [no-autoconfig] [off-link]

The prefix is advertised to remain valid until the specific date and time are reached. The valid lifetime is given as valid_date_time, and the prefix is preferred until preferred_date_time is reached.

Each date and time value is given in this form:

The month is the month name, given as at least three characters. The day is 1 to 31. The time is always given in 24-hour format.

For example, suppose the prefix 1999::/64 is advertised to expire at 23:59 on December 31 for the valid and preferred lifetimes. You could use the following command to accomplish this:

Firewall(config)# ipv6 nd prefix 1999::/64 dec 31 23:59 dec 31 23:59

d. (Optional) Do not advertise a prefix:

Firewall(config-if)# ipv6 nd prefix {default | ipv6_address/prefix_length} no-advertise

The prefix given is not advertised.

Testing IPv6 Connectivity

As soon as you configure IPv6 operation on a firewall, make sure each of the respective interfaces has an IPv6 address. An interface must have a link-local address to communicate with its neighbors. An interface must also have a global address to be able to forward packets to other IPv6 destination addresses. You can display these addresses with the show ipv6 interface command.

You can display any other IPv6 routers that the firewall has discovered from router advertisements it has received. Confirm any entries seen with the show ipv6 routers command, as in the following example:

Firewall# show ipv6 routers

Router fe80::260:70ff:fed7:8800 on inside, last update 1 min Hops 64, Lifetime 1800 sec, AddrFlag=0, OtherFlag=0, MTU=1500 Reachable time 0 msec, Retransmit time 0 msec Prefix 1999::/64 onlink autoconfig

Valid lifetime 2592000, preferred lifetime 604800 Firewall#

From the fe80 digits in the most-significant IPv6 address positions, you can distinguish the router address shown as a link-local address.

You can also use a form of the ping command to send IPv6 ICMP echo packets to a neighboring device with the following simplified syntax:

Firewall# ping [if name] ipv6 address

With the preceding router example, you could ping the router's IPv6 link-local address to determine good connectivity and a working IPv6 configuration. The following example shows an attempted ping:

Code View: Scroll / Show All

Firewall# ping fe80::260:70ff:fed7:8800

Sending 5, 100-byte ICMP Echos to fe80::260:70ff:fed7:8800, timeout is 2 seconds:

Interface must be specified for link-local or multicast address

Success rate is 0 percent (0/1)

Firewall#

Because a link-local address is being used as the ping target, the firewall cannot determine which of its interfaces to use. This is because link-local addresses do not include any network or route information that could be used to find a destination interface. The example is repeated with the interface information as follows, showing a series of successful ICMP echo and reply packets:

Code View: Scroll / Show All

Firewall# ping inside fe80::260:70ff:fed7:8800

Sending 5, 100-byte ICMP Echos to fe80::260:70ff:fed7:8800, timeout is 2 seconds: !!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/1 ms Firewall#

Continue reading here: Configuring the ARP Cache

Was this article helpful?

0 0