Configure Ipv6 Inspection; Configure An Ipv6 Inspection Policy Map - Cisco ASA Series Configuration Manual

IPv6 Inspection

Configure IPv6 Inspection

IPv6 inspection is not enabled by default. You must configure it if you want IPv6 inspection.
Procedure
Step 1 Configure an IPv6 Inspection Policy Map, page
Step 2 Configure the IPv6 Inspection Service Policy, page

Configure an IPv6 Inspection Policy Map

To identify extension headers to drop or log, or to disable packet verification, create an IPv6 inspection
policy map to be used by the service policy.
Procedure
Step 1 Create an IPv6 inspection policy map.
hostname(config)# policy-map type inspect ipv6 policy_map_name
hostname(config-pmap)#
Where the policy_map_name is the name of the policy map. The CLI enters policy-map configuration
mode.
(Optional) Add a description to the policy map.
Step 2
hostname(config-pmap)# description string
(Optional) Drop or log traffic based on the headers in IPv6 messages.
Step 3
a.
b.
Cisco ASA Series Firewall CLI Configuration Guide
13-34
Identify the traffic based on the IPv6 header.
hostname(config-pmap)# match header type
Where type is one of the following:
ah—Matches the IPv6 Authentication extension header.
•
count gt number—Specifies the maximum number of IPv6 extension headers, from 0 to 255.
•
• destination-option—Matches the IPv6 destination-option extension header.
• esp—Matches the IPv6 Encapsulation Security Payload (ESP) extension header.
• fragment—Matches the IPv6 fragment extension header.
hop-by-hop—Matches the IPv6 hop-by-hop extension header.
•
routing-address count gt number—Sets the maximum number of IPv6 routing header type 0
•
addresses, greater than a number between 0 and 255.
routing-type {eq | range} number—Matches the IPv6 routing header type, from 0 to 255. For
•
a range, separate values by a space, for example, 30 40.
Specify the action to perform on matching packets. You can drop the packet and optionally log it,
or just log it. If you do not enter an action, the packet is logged.
hostname(config-pmap)# {drop [log] | log}
Chapter 13 Inspection of Basic Internet Protocols
13-34.
13-35.