Cisco 500 Series, Configuration Manual

Page: 195 / 1140

12-5
Cisco Security Appliance Command Line Configuration Guide
OL-12172-03
Chapter 12 Configuring IPv6
Configuring IPv6
Duplicate address detection is suspended on interfaces that are administratively down. While an
interface is administratively down, the unicast IPv6 addresses assigned to the interface are set to a
pending state. An interface returning to an administratively up state restarts duplicate address detection
for all of the unicast IPv6 addresses on the interface.
When a duplicate address is identified, the state of the address is set to DUPLICATE, the address is not
used, and the following error message is generated:
%PIX|ASA-4-325002: Duplicate address ipv6_address / MAC_address on interface
If the duplicate address is the link-local address of the interface, the processing of IPv6 packets is
disabled on the interface. If the duplicate address is a global address, the address is not used. However,
all configuration commands associated with the duplicate address remain as configured while the state
of the address is set to DUPLICATE.
If the link-local address for an interface changes, duplicate address detection is performed on the new
link-local address and all of the other IPv6 address associated with the interface are regenerated
(duplicate address detection is performed only on the new link-local address).
The security appliance uses neighbor solicitation messages to perform duplicate address detection. By
default, the number of times an interface performs duplicate address detection is 1.
To change the number of duplicate address detection attempts, enter the following command:
hostname(config-if)# ipv6 nd dad attempts value
The value argument can be any value from 0 to 600. Setting the value argument to 0 disables duplicate
address detection on the interface.
When you configure an interface to send out more than one duplicate address detection attempt, you can
also use the
ipv6 nd ns-interval command to configure the interval at which the neighbor solicitation
messages are sent out. By default, they are sent out once every 1000 milliseconds.
To change the neighbor solicitation message interval, enter the following command:
hostname(config-if)# ipv6 nd ns-interval
value
The value argument can be from 1000 to 3600000 milliseconds.
Note
Changing this value changes it for all neighbor solicitation messages sent out on the interface, not just
those used for duplicate address detection.
Configuring IPv6 Default and Static Routes
The security appliance automatically routes IPv6 traffic between directly connected hosts if the
interfaces to which the hosts are attached are enabled for IPv6 and the IPv6 ACLs allow the traffic.
The security appliance does not support dynamic routing protocols. Therefore, to route IPv6 traffic to a
non-connected host or network, you need to define a static route to the host or network or, at a minimum,
a default route. Without a static or default route defined, traffic to non-connected hosts or networks
generate the following error message:
%PIX|ASA-6-110001: No route to dest_address from source_address
You can add a default route and static routes using the ipv6 route command.
To configure an IPv6 default route and static routes, perform the following steps: