Cisco ASA Series Cli Configuration Manual page 469

Chapter 1 Completing Interface Configuration (Routed Mode)
This section includes the following topics:
•
•
•
Information About IPv6
This section includes information about how to configure IPv6, and includes the following topics:
•
•
IPv6 Addressing
You can configure two types of unicast addresses for IPv6:
•
•
At a minimum, you need to configure a link-local address for IPv6 to operate. If you configure a global
address, a link-local address is automatically configured on the interface, so you do not also need to
specifically configure a link-local address. If you do not configure a global address, then you need to
configure the link-local address, either automatically or manually.
Note
If you want to only configure the link-local addresses, see the ipv6 enable (to auto-configure) or ipv6
address link-local (to manually configure) command in the command reference.
Modified EUI-64 Interface IDs
RFC 3513: Internet Protocol Version 6 (IPv6) Addressing Architecture requires that the interface
identifier portion of all unicast IPv6 addresses, except those that start with binary value 000, be 64 bits
long and be constructed in Modified EUI-64 format. The ASA can enforce this requirement for hosts
attached to the local link.
When this feature is enabled on an interface, the source addresses of IPv6 packets received on that
interface are verified against the source MAC addresses to ensure that the interface identifiers use the
Modified EUI-64 format. If the IPv6 packets do not use the Modified EUI-64 format for the interface
identifier, the packets are dropped and the following system log message is generated:
%ASA-3-325003: EUI-64 source address check failed.
The address format verification is only performed when a flow is created. Packets from an existing flow
are not checked. Additionally, the address verification can only be performed for hosts on the local link.
Packets received from hosts behind a router will fail the address format verification, and be dropped,
because their source MAC address will be the router MAC address and not the host MAC address.
Configuring a Global IPv6 Address
To configure a global IPv6 address, perform the following steps.
Information About IPv6, page 1-13
Configuring a Global IPv6 Address, page 1-13
Configuring IPv6 Neighbor Discovery, page 1-15
IPv6 Addressing, page 1-13
Modified EUI-64 Interface IDs, page 1-13
Global—The global address is a public address that you can use on the public network.
Link-local—The link-local address is a private address that you can only use on the
directly-connected network. Routers do not forward packets using link-local addresses; they are
only for communication on a particular physical network segment. They can be used for address
configuration or for the ND functions such as address resolution and neighbor discovery.
Completing Interface Configuration in Routed Mode
Cisco ASA Series CLI Configuration Guide
1-13