Cisco ASA 5506-X Configuration Manual page 180

IPv6 Inspection
Configure IPv6 Inspection
IPv6 inspection is not enabled by default. You must configure it if you want IPv6 inspection.
Procedure
Step 1 Configure an IPv6 Inspection Policy Map, page
Step 2 Configure the IPv6 Inspection Service Policy, page
Configure an IPv6 Inspection Policy Map
To identify extension headers to drop or log, or to disable packet verification, create an IPv6 inspection
policy map to be used by the service policy.
Procedure
Step 1 Create an IPv6 inspection policy map.
hostname(config)# policy-map type inspect ipv6 policy_map_name
hostname(config-pmap)#
Where the policy_map_name is the name of the policy map. The CLI enters policy-map configuration
mode.
(Optional) Add a description to the policy map.
Step 2
hostname(config-pmap)# description string
(Optional) Drop or log traffic based on the headers in IPv6 messages.
Step 3
a.
b.
Cisco ASA Series Firewall CLI Configuration Guide
7-34
Identify the traffic based on the IPv6 header.
hostname(config-pmap)# match header type
Where type is one of the following:
ah—Matches the IPv6 Authentication extension header.
•
count gt number—Specifies the maximum number of IPv6 extension headers, from 0 to 255.
•
• destination-option—Matches the IPv6 destination-option extension header.
• esp—Matches the IPv6 Encapsulation Security Payload (ESP) extension header.
• fragment—Matches the IPv6 fragment extension header.
hop-by-hop—Matches the IPv6 hop-by-hop extension header.
•
routing-address count gt number—Sets the maximum number of IPv6 routing header type 0
•
addresses, greater than a number between 0 and 255.
routing-type {eq | range} number—Matches the IPv6 routing header type, from 0 to 255. For
•
a range, separate values by a space, for example, 30 40.
Specify the action to perform on matching packets. You can drop the packet and optionally log it,
or just log it. If you do not enter an action, the packet is logged.
hostname(config-pmap)# {drop [log] | log}
Chapter 7 Inspection of Basic Internet Protocols
7-34.
7-35.