IPv6 traffic filter

3.2 Troubleshoot router security features

📘CCNP Enterprise – ENARSI (300-410)

---

An IPv6 traffic filter is essentially a way to control or restrict IPv6 network traffic on a router or Layer 3 device. It works similarly to IPv4 Access Control Lists (ACLs), but it is designed specifically for IPv6. These filters are crucial for router security, because they help prevent unauthorized access, control traffic flow, and protect against attacks.

---

1. IPv6 Traffic Filtering Basics

1. Why we use IPv6 traffic filters
   • To permit or deny traffic to or from specific IPv6 addresses or networks.
   • To control which protocols (like ICMPv6, TCP, UDP) can traverse a router interface.
   • To secure router resources, preventing unnecessary or malicious traffic.
   • To enforce company security policies on IPv6 networks.
2. Key Differences Between IPv4 and IPv6 Filters
   • IPv6 uses extended ACLs only; there are no “standard” IPv6 ACLs.
     • Standard ACLs (IPv4) filter only by source IP.
     • IPv6 ACLs filter by source IP, destination IP, and protocol.
   • IPv6 ACLs are named, not numbered.
   • IPv6 ACLs do not use wildcard masks like IPv4; instead, they use prefix-length notation (e.g., /64).
   • IPv6 has ICMPv6, which is required for proper network functioning. Some ICMPv6 types must not be blocked (e.g., Neighbor Discovery, Router Advertisements).

---

2. IPv6 ACL Structure

IPv6 traffic filters are also called IPv6 ACLs. The structure is:

ipv6 access-list <ACL_NAME>
   permit|deny <protocol> <source> [source-prefix-length] <destination> [destination-prefix-length] [operators]

Components Explained

• ACL Name: A unique, descriptive name (example: BLOCK-EXTERNAL).
• permit / deny: Action for matching traffic.
• Protocol: IPv6 protocol type (e.g., TCP, UDP, ICMP, or ipv6 for all IPv6 traffic).
• Source / Destination: IPv6 addresses with optional prefix length.
• Operators (optional): e.g., port numbers (eq 80) for TCP/UDP.

Example

ipv6 access-list BLOCK-SSH
  deny tcp any any eq 22
  permit ipv6 any any

• This denies all SSH traffic (TCP port 22) and permits all other IPv6 traffic.
• Note: The order matters—ACLs are processed top to bottom, first match wins.

---

3. Applying IPv6 Traffic Filters

IPv6 ACLs are applied directly to interfaces. This is done in interface configuration mode, using either:

1. Inbound (incoming traffic) interface GigabitEthernet0/0 ipv6 traffic-filter BLOCK-SSH in
2. Outbound (outgoing traffic) interface GigabitEthernet0/0 ipv6 traffic-filter BLOCK-SSH out

Inbound vs Outbound

• Inbound: Filters packets as they arrive at the interface. Helps prevent malicious traffic from entering.
• Outbound: Filters packets as they leave the interface. Helps prevent internal traffic from leaking or misbehaving.

---

4. Important IPv6 Protocol Considerations

When creating IPv6 traffic filters, remember:

1. ICMPv6 is critical
   • IPv6 depends on ICMPv6 for:
     • Neighbor Discovery (ND)
     • Path MTU Discovery
     • Router Advertisements (RA)
   • Blocking all ICMPv6 traffic can break your network. Always permit essential ICMPv6 types.
2. IPv6 prefixes
   • Unlike IPv4, IPv6 addresses are long. Use prefix-length to specify networks efficiently.
   • Example: 2001:db8:1::/64 filters the first 64 bits of the address.
3. Protocol-specific filtering
   • You can filter based on protocol types:
     • TCP, UDP, ICMP, or any IPv6 traffic
   • You can also filter specific ports for TCP/UDP.

---

5. Troubleshooting IPv6 Traffic Filters

When troubleshooting:

1. Check ACL applicationshow ipv6 interface
   • Shows which ACL is applied inbound or outbound.
2. Check ACL countersshow ipv6 access-list <ACL_NAME>
   • Displays how many packets matched each permit/deny entry. Useful to see if traffic is being blocked as intended.
3. Common issues
   • Blocking essential ICMPv6 types: Can disrupt routing and neighbor discovery.
   • Order of rules: Remember, first match wins.
   • Not applying ACL to interface: Creating an ACL is not enough; it must be applied.

---

6. Exam Tips – IPv6 Traffic Filters

• Remember naming: IPv6 ACLs must be named; no numbers.
• Permit necessary ICMPv6: Neighbor Discovery, RA, RS messages.
• Order matters: First match wins.
• Check interface: ACL must be applied to the correct interface and direction.
• Test ACLs: Use ping, traceroute, and show commands to verify functionality.

Example Exam Question Style:

A router must block SSH traffic over IPv6 while allowing all other traffic. Which configuration accomplishes this?

Answer:

ipv6 access-list BLOCK-SSH
  deny tcp any any eq 22
  permit ipv6 any any
interface G0/0
  ipv6 traffic-filter BLOCK-SSH in

---

✅ Key Points to Remember

• IPv6 ACL = IPv6 traffic filter.
• Named ACLs only, no numbers.
• Use prefix-length, not wildcard masks.
• Permit critical ICMPv6 types to avoid network issues.
• Apply ACL to interface inbound or outbound as needed.
• Use show commands to verify and troubleshoot.