Cisco ASA 5506-X Configuration Manual page 181

Chapter 7 Inspection of Basic Internet Protocols
c.
Configure parameters that affect the inspection engine.
Step 4
a.
b.
Examples
The following example creates an inspection policy map that will drop and log all IPv6 packets with the
hop-by-hop, destination-option, routing-address, and routing type 0 headers. It also enforces header
order and type.
policy-map type inspect ipv6 ipv6-pm
parameters
verify-header type
verify-header order
match header hop-by-hop
drop log
match header destination-option
drop log
match header routing-address count gt 0
drop log
match header routing-type eq 0
drop log
policy-map global_policy
class class-default
inspect ipv6 ipv6-pm
!
service-policy global_policy global
Configure the IPv6 Inspection Service Policy
IPv6 inspection is not enabled in the default inspection policy, so you must enable it if you need this
inspection. You can simply edit the default global inspection policy to add IPv6 inspection. You can
alternatively create a new service policy as desired, for example, an interface-specific policy.
Procedure
If necessary, create an L3/L4 class map to identify the traffic for which you want to apply the inspection.
Step 1
class-map name
match parameter
Example:
hostname(config)# class-map ipv6_class_map
hostname(config-cmap)# match access-list ipv6
Repeat the process until you identify all headers that you want to drop or log.
Enter parameters configuration mode.
hostname(config-pmap)# parameters
hostname(config-pmap-p)#
Set one or more parameters. You can set the following options; use the no form of the command to
disable the option:
verify-header type—Allows only known IPv6 extension headers.
•
• verify-header order—Enforces the order of IPv6 extension headers as defined in RFC 2460.
Cisco ASA Series Firewall CLI Configuration Guide
IPv6 Inspection
7-35