On Wed, 12 Sep 2012, Justin M. Streiner wrote:
A number of people have asked to see the ruleset, so I've posted it here:
http://www.cluebyfour.org/ipv6/
What I've posted is the IPv6 portion of the configuration for my test zone.
I see a number of people have viewed the config since I posted it. If
anyone has questions/comments/suggestions/concerns, please feel free to
post them here.
Thanks
jms
On Fri, 7 Sep 2012, Justin M. Streiner wrote:
This is as much of a general query as anything else. I'm just trying to
get a sense for how people are building default firewall rule sets on
their ASAs.
I have a fairly detailed inbound and outbound default IPv6 firewall rule
set worked up, which I can share with people who are interested. SLAAC
and any type of 'normal' IPv6 traffic I could come up with in my lab works
just fine. I wrote rules for DHCPv6, but haven't tested them yet - hoping
to have a DHCPv6 server online in the next week or two.
Most of the default rules cover stuff like SLAAC, the various ICMPv6
messages that are required/desirable to pass (per RFC 4890), and some
other stuff I've found through trial and error that needed to be on for
IPv6 to work.
I'm still wrapping my head around IPv6 inspection and what
explicitly-defined rules I can knock out of my ruleset, if any, because
the inspection would cover them. IPv6 inspection on the ASA doesn't seem
to be terribly intuitive/functional at this point and not especially well
documented. Are people even bothering with this right now?
The test environment an ASA 5540 running 8.4(4)1 code and ASDM 6.4(9) at
the moment. The IPv6 test network dual-stacked and the firewall is
running in transparent mode.
jms
_______________________________________________
cisco-nsp mailing list [email protected]
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/
_______________________________________________
cisco-nsp mailing list [email protected]
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/
_______________________________________________
cisco-nsp mailing list [email protected]
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/
