Pv6enabled Commands

Chapter 12 Configuring IPv6 |

1 Configuring IPv6

Note

Failover does not support IPv6. The ipv6 address command does not support setting standby addresses for failover configurations. The failover interface ip command does not support using IPv6 addresses on the failover and Stateful Failover interfaces.

When entering IPv6 addresses in commands that support them, simply enter the IPv6 address using standard IPv6 notation, for example ping fe80: :2e0:b6ff :feoi:3b7a. The security appliance correctly recognizes and processes the IPv6 address. However, you must enclose the IPv6 address in square brackets ([ ]) in the following situations:

• You need to specify a port number with the address, for example

[fe80::2e0:b6ff:fe01:3b7a]:8080.

• The command uses a colon as a separator, such as the write net and config net commands, for example configure net [fe80::2e0:b6ff:fe01:3b7a]:/tftp/config/pixconfig.

The following commands were modified to work for IPv6:

• debug

• fragment

• ip verify

• mtu

• icmp (entered as ipv6 icmp)

The following inspection engines support IPv6:

• FTP

• HTTP

• ICMP

• SMTP

• TCP

• UDP

Configuring IPv6

This section contains the following topics:

• Configuring IPv6 on an Interface, page 12-3

• Configuring a Dual IP Stack on an Interface, page 12-4

• Enforcing the Use of Modified EUI-64 Interface IDs in IPv6 Addresses, page 12-4

• Configuring IPv6 Duplicate Address Detection, page 12-4

• Configuring IPv6 Default and Static Routes, page 12-5

• Configuring IPv6 Access Lists, page 12-6

• Configuring IPv6 Neighbor Discovery, page 12-7

• Configuring a Static IPv6 Neighbor, page 12-11

Configuring

IPv6 on an Interface

At a minimum, each interface needs to be configured with an IPv6 link-local address. Additionally, you

can add a site-local and global address to the interface.

%

Note

The security appliance does not support IPv6 anycast addresses.

You can configure both IPv6 and IPv4 addresses on an interface.

To configure IPv6 on an interface, perform the following steps:

Step 1

Enter interface configuration mode for the interface on which you are configuring the IPv6 addresses:

hostname(config)# interface if

Step 2

Configure an IPv6 address on the interface. You can assign several IPv6 addresses to an interface, such

as an IPv6 link-local, site-local, and global address. However, at a minimum, you must configure a

link-local address.

There are several methods for configuring IPv6 addresses. Pick the method that suits your needs from

the following:

• The simplest method is to enable stateless autoconfiguration on the interface. Enabling stateless

autoconfiguration on the interface configures IPv6 addresses based on prefixes received in Router

Advertisement messages. A link-local address, based on the Modified EUI-64 interface ID, is

automatically generated for the interface when stateless autoconfiguration is enabled. To enable

stateless autoconfiguration, enter the following command:

hostname(config-if)# ipv6 address autoconfig

• If you only need to configure a link-local address on the interface and are not going to assign any

other IPv6 addresses to the interface, you have the option of manually defining the link-local address

or generating one based on the interface MAC address (Modified EUI-64 format):

- Enter the following command to manually specify the link-local address:

hostname(config-if)# ipv6 address ipv6-address link-local

- Enter the following command to enable IPv6 on the interface and automatically generate the

link-local address using the Modified EUI-64 interface ID based on the interface MAC address:

hostname(config-if)# ipv6 enable

X

Note You do not need to use the ipv6 enable command if you enter any other ipv6 address

commands on an interface; IPv6 support is automatically enabled as soon as you assign an

IPv6 address to the interface.

• Assign a site-local or global address to the interface. When you assign a site-local or global address,

a link-local address is automatically created. Enter the following command to add a global or

site-local address to the interface. Use the optional eui-64 keyword to use the Modified EUI-64

interface ID in the low order 64 bits of the address.

hostname(config-if)# ipv6 address ipv6-address [eui-64]