Hi List,
I would like to filter the incoming IPv6 traffic from upstream and peering relatively strong like I do it for IPv4 (no martian src allowed, Traffic on the link to upstream/peerinc allowed, my and customers prefixes allowed as dst ). Having link-local addresses will complicate this , also the ND etc. So I came up to a relatively long ACL and big question-marks: 1. With classical IOS, "IP" Rules include icmp, udp, tcp ,... Is this also true on IOS-XR for IPv6 ? 2. On the Neighbor Discovery ets stuff is src and dst allway link-lokal or must I allow explicit the four pairs LL-LL LL-real real-LL real-real ? 3. will that ACL work on the mentioned devices in Hardware or is it done in software slowing down everything ? With 1. And 2. I could probably short the sketch below down and avoid unspecific icmp "any any "rules !========== ipv6 access-list AL6-FILTER-IN ! from http://www.bgp4all.com.au/pfs/_media/workshops/12-ipv6-security.pdf 2000 permit icmpv6 any any echo-reply 2010 permit icmpv6 any any echo-request 2020 permit icmpv6 any any 1 3 2030 permit icmpv6 any any 1 4 2040 permit icmpv6 any any packet-too-big 2050 permit icmpv6 any any time-exceeded 2060 permit icmpv6 any any parameter-problem ! not accepted 2070 permit icmpv6 any any mld-query ! not accepted 2080 permit icmpv6 any any mld-reduction ! not accepted 2090 permit icmpv6 any any mld-report 2100 permit icmpv6 any any nd-na 2110 permit icmpv6 any any nd-ns 2120 permit icmpv6 any any router-solicitation !HSRP 2200 permit udp FE80::/16 eq 2029 host FF02::66 eq 2029 2900 deny icmpv9 any any ! ! tmp block bad src 3000 deny ipv6 2605:9880:300::/48 any ! ! transit to upstreams and peering 6000 permit ipv6 2001:qwer::1234/126 2001:qwer::1234/126 6020 permit ipv6 2001:789::/64 2001:789::/64 6030 permit ipv6 2001:asdf:ghjk:uiop::/64 2001:asdf:ghjk:uiop::/64 ! !! my and customers ipv6 ranges src ! wrong direction !7000 permit ipv6 2a00:xxxx:/32 any !7100 permit ipv6 2a01:asdf::/32 any ! ! my and customers ipv6 ranges dst 8000 permit ipv6 any 2a00:xxxx::/32 8100 permit ipv6 any 2a01:asdf::/32 ! 9000 deny ipv6 any any ! !========== Thank you for suggestions on how do do this "right", Juergen. _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
