Silly question - How come you are having to deny certain things, if traffic from a lower security interface tries to access a higher security interface unless its permit it should be denied by default. Are you putting those deny statements in there just to log the hits? Also notice there is a deny ip any any. At the end of the access-list there is already an implied deny if nothing matches.
On Thu, Sep 13, 2012 at 1:01 PM, Justin M. Streiner <[email protected]> wrote: > On Wed, 12 Sep 2012, Justin M. Streiner wrote: > >> A number of people have asked to see the ruleset, so I've posted it here: >> >> http://www.cluebyfour.org/ipv6/ >> >> What I've posted is the IPv6 portion of the configuration for my test >> zone. > > > I see a number of people have viewed the config since I posted it. If > anyone has questions/comments/suggestions/concerns, please feel free to post > them here. > > Thanks > > jms > >> On Fri, 7 Sep 2012, Justin M. Streiner wrote: >> >>> This is as much of a general query as anything else. I'm just trying to >>> get a sense for how people are building default firewall rule sets on >>> their ASAs. >>> >>> I have a fairly detailed inbound and outbound default IPv6 firewall rule >>> set worked up, which I can share with people who are interested. SLAAC >>> and any type of 'normal' IPv6 traffic I could come up with in my lab >>> works >>> just fine. I wrote rules for DHCPv6, but haven't tested them yet - >>> hoping >>> to have a DHCPv6 server online in the next week or two. >>> >>> Most of the default rules cover stuff like SLAAC, the various ICMPv6 >>> messages that are required/desirable to pass (per RFC 4890), and some >>> other stuff I've found through trial and error that needed to be on for >>> IPv6 to work. >>> >>> I'm still wrapping my head around IPv6 inspection and what >>> explicitly-defined rules I can knock out of my ruleset, if any, because >>> the inspection would cover them. IPv6 inspection on the ASA doesn't >>> seem >>> to be terribly intuitive/functional at this point and not especially >>> well >>> documented. Are people even bothering with this right now? >>> >>> The test environment an ASA 5540 running 8.4(4)1 code and ASDM 6.4(9) at >>> the moment. The IPv6 test network dual-stacked and the firewall is >>> running in transparent mode. >>> >>> jms >>> >>> _______________________________________________ >>> cisco-nsp mailing list [email protected] >>> https://puck.nether.net/mailman/listinfo/cisco-nsp >>> archive at http://puck.nether.net/pipermail/cisco-nsp/ >>> >> _______________________________________________ >> cisco-nsp mailing list [email protected] >> https://puck.nether.net/mailman/listinfo/cisco-nsp >> archive at http://puck.nether.net/pipermail/cisco-nsp/ >> > _______________________________________________ > cisco-nsp mailing list [email protected] > https://puck.nether.net/mailman/listinfo/cisco-nsp > archive at http://puck.nether.net/pipermail/cisco-nsp/ _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
