IPv6 Firewall Cisco IOS ACL based - Revision history

Heth: added Category:IPv6 Security using HotCat

2014-05-21T10:41:16Z

added Category:IPv6 Security using HotCat

Heth: removed Category:Security using HotCat

2014-05-21T10:41:05Z

removed Category:Security using HotCat

Heth: removed Category:IPv6 using HotCat

2014-05-21T10:41:00Z

removed Category:IPv6 using HotCat

Heth: /* Applying the access lists */

2014-05-21T10:39:01Z

‎Applying the access lists

Heth: /* Internet outbound trafic */

2014-05-21T09:57:42Z

‎Internet outbound trafic

Heth: /* Internet inbound trafic */

2014-05-21T09:57:08Z

‎Internet inbound trafic

Heth: added Category:Firewall using HotCat

2014-05-21T09:44:47Z

added Category:Firewall using HotCat

Heth: added Category:Security using HotCat

2014-05-21T09:44:38Z

added Category:Security using HotCat

Heth: added Category:IPv6 using HotCat

2014-05-21T09:44:26Z

added Category:IPv6 using HotCat

Heth: Created page with "IPv6 Firewall example IPv6 firewall example using access lists. =Access-lists as firewall= One of the fundamental problems with A..."

2014-05-21T09:43:46Z

Created page with "thumb|300px|right|IPv6 Firewall example IPv6 firewall example using access lists. =Access-lists as firewall= One of the fundamental problems with A..."

New page

[[image:IPv6_firewall_1.png|thumb|300px|right|IPv6 Firewall example]]
IPv6 firewall example using access lists.

=Access-lists as firewall=
One of the fundamental problems with ACLs is the fact that they do not maintain state information about the traffic flows. ACLs do not observe what host on which interface initiated the conversation or which end of the conversation is the client and which end is the server. Standard ACLs do not have any concept of TCP SYN, SYN ACK, ACK, or FIN flags and their influence on a TCP establishment and connection. Therefore, ACLs tend to be less granular than policies that are configured on a fully stateful packet-filtering firewall. ACLs might be fast but they are not extremely precise.

*See [[IPv6 Firewall Cisco IOS Reflexive ACL]]
==Internet inbound trafic==
<source lang=cli>
ipv6 access-list Internet-Inbound
remark Deny loopback address
deny ipv6 ::1/128 any
remark Deny IPv4-compatible addresses
deny ipv6 0::/96 any
remark Deny IPv4-mapped addresses (obsolete)
deny ipv6 ::ffff:0.0.0.0/96 any
remark Deny auto tunneled packets w/compatible addresses (RFC 4291)
deny ipv6 ::0.0.0.0/96 any
remark Deny other compatible addresses
deny ipv6 ::224.0.0.0/100 any log
deny ipv6 ::127.0.0.0/104 any log
deny ipv6 ::0.0.0.0/104 any log
deny ipv6 ::255.0.0.0/104 any log
remark Deny false 6to4 packets
deny ipv6 2002:e000::/20 any log
deny ipv6 2002:7f00::/24 any log
deny ipv6 2002:0000::/24 any log
deny ipv6 2002:ff00::/24 any log
deny ipv6 2002:0a00::/24 any log
deny ipv6 2002:ac10::/28 any log
deny ipv6 2002:c0a8::/32 any log
remark Permit good NDP messages since we deny and log at the end
permit icmp fe80::/10 any nd-na
permit icmp fe80::/10 any nd-ns
remark Deny Link-Local communications
deny ipv6 fe80::/10 any
remark Deny Site-Local (deprecated)
deny ipv6 fec0::/10 any
remark Deny Unique-Local packets
deny ipv6 fc00::/7 any
remark Deny multicast packets
deny ipv6 ff00::/8 any
remark Deny Documentation Address
deny ipv6 2001:db8::/32 any
remark Deny 6Bone addresses (deprecated)
deny ipv6 3ffe::/16 any
remark Deny RH0 packets
deny ipv6 any any routing-type 0 log
remark Deny our own addresses coming inbound
deny ipv6 2001:db8:11::/48 any log
remark permit BGP to and from our EBGP neighbor
permit tcp host 2001:db8:4::1 host 2001:db8:4::2 eq bgp
permit tcp host 2001:db8:4::1 eq bgp host 2001:db8:4::2
remark Permit traffic to our web server
permit tcp any host 2001:db8:11::100 eq www
remark Permit our returned traffic from internal clients
permit tcp any 2001:db8:11::/48 range 1024 65535
permit udp any 2001:db8:11::/48 range 1024 65535
remark Permit inbound DNS responses to our internal caching DNS server
permit udp any eq domain host 2001:db8:11:30:20c:29ff:fe5d:982a
remark Permit good ICMPv6 message types
permit icmp any 2001:db8:11::/48 destination-unreachable
permit icmp any 2001:db8:11::/48 packet-too-big
permit icmp any 2001:db8:11::/48 parameter-problem
permit icmp any 2001:db8:11::/48 echo-reply
remark Permit our ISP to ping our external interface
permit icmp host 2001:db8:4::1 host 2001:db8:4::2 echo-request
remark Deny everything else and log it
deny ipv6 any any log
</source>
==Internet outbound trafic==
<source lang=cli>
ipv6 access-list Internet-Outbound
remark Deny loopback address
deny ipv6 any ::1/128
remark Deny IPv4-compatible addresses
deny ipv6 any 0::/96
remark Deny IPv4-mapped addresses (obsolete)
deny ipv6 any ::ffff:0.0.0.0/96
remark Deny auto tunneled packets w/compatible addresses (RFC 4291)
deny ipv6 any ::0.0.0.0/96
remark Deny other compatible addresses
deny ipv6 any ::224.0.0.0/100 log
deny ipv6 any ::127.0.0.0/104 log
deny ipv6 any ::0.0.0.0/104 log
deny ipv6 any ::255.0.0.0/104 log
remark Deny false 6to4 packets
deny ipv6 any 2002:e000::/20 log
deny ipv6 any 2002:7f00::/24 log
deny ipv6 any 2002:0000::/24 log
deny ipv6 any 2002:ff00::/24 log
deny ipv6 any 2002:0a00::/24 log
deny ipv6 any 2002:ac10::/28 log
deny ipv6 any 2002:c0a8::/32 log
remark Permit good NDP messages since we deny and log at the end
permit icmp fe80::/10 any nd-na
permit icmp fe80::/10 any nd-ns
remark Deny Link-Local communications
deny ipv6 any fe80::/10
remark Deny Site-Local (deprecated)
deny ipv6 any fec0::/10
remark Deny Unique-Local packets
deny ipv6 any fc00::/7
remark Deny multicast packets
deny ipv6 any ff00::/8
remark Deny Documentation Address
deny ipv6 any 2001:db8::/32
remark Deny 6Bone addresses (deprecated)
deny ipv6 any 3ffe::/16
remark Deny RH0 packets
deny ipv6 any any routing-type 0 log
remark Permit outbound DNS requests from our internal caching DNS server
permit udp host 2001:db8:11:30:20c:29ff:fe5d:982a any eq domain
remark Permit good ICMPv6 message types
permit icmp 2001:db8:11::/48 any destination-unreachable
permit icmp 2001:db8:11::/48 any packet-too-big
permit icmp 2001:db8:11::/48 any parameter-problem
permit icmp 2001:db8:11::/48 any echo-reply
remark Permit our own addresses going outbound
permit ipv6 2001:db8:11::/48 any
remark Deny everything else and log it
deny ipv6 any any log
</source>
==Applying the access lists==
<source lang=cli>
interface FastEthernet 0/0
description Link to IPv6 Internet
ipv6 address 2001:db8:4::2/64
ipv6 traffic-filter Internet-Inbound in
interface FastEthernet 0/1
description Link to internal IPv6 network
ipv6 address 2001:db8:11::1/64
ipv6 traffic-filter Internet-Outbound in
</source>

← Older revision		Revision as of 10:41, 21 May 2014
Line 141:		Line 141:

	[[Category:Firewall]]		[[Category:Firewall]]
		+	[[Category:IPv6 Security]]

← Older revision		Revision as of 10:41, 21 May 2014
Line 140:		Line 140:
	</source>		</source>

−	~~[[Category:Security]]~~
	[[Category:Firewall]]		[[Category:Firewall]]

@@ Line 140: / Line 140: @@
 </source>
 [[Category:Security]]
 [[Category:Firewall]]

← Older revision		Revision as of 09:44, 21 May 2014
Line 136:		Line 136:
	[[Category:IPv6]]		[[Category:IPv6]]
	[[Category:Security]]		[[Category:Security]]
		+	[[Category:Firewall]]

← Older revision		Revision as of 09:44, 21 May 2014
Line 135:		Line 135:

	[[Category:IPv6]]		[[Category:IPv6]]
		+	[[Category:Security]]

@@ Line 131: / Line 131: @@
   description Link to IPv6 Internet
   ipv6 address 2001:db8:4::2/64
   ipv6 traffic-filter Internet-Inbound in
 interface FastEthernet 0/1
   description Link to internal IPv6 network
   ipv6 address 2001:db8:11::1/64
   ipv6 traffic-filter Internet-Outbound in
 </source>

@@ Line 117: / Line 117: @@
   permit icmp 2001:db8:11::/48 any destination-unreachable
   permit icmp 2001:db8:11::/48 any packet-too-big
   permit icmp 2001:db8:11::/48 any parameter-problem
   permit icmp 2001:db8:11::/48 any echo-reply
@@ Line 124: / Line 125: @@
   deny ipv6 any any log
 </source>
 ==Applying the access lists==
 <source lang=cli>

@@ Line 62: / Line 62: @@
   permit icmp any 2001:db8:11::/48 destination-unreachable
   permit icmp any 2001:db8:11::/48 packet-too-big
   permit icmp any 2001:db8:11::/48 parameter-problem
   permit icmp any 2001:db8:11::/48 echo-reply
@@ Line 69: / Line 70: @@
   deny ipv6 any any log
 </source>
 ==Internet outbound trafic==
 <source lang=cli>

← Older revision		Revision as of 09:44, 21 May 2014
Line 133:		Line 133:
	ipv6 traffic-filter Internet-Outbound in		ipv6 traffic-filter Internet-Outbound in
	</source>		</source>
		+
		+	[[Category:IPv6]]