Cisco 5505 - ASA Firewall Edition Bundle, Cli Configuration Manual

Page: 1134 / 2164

1-28
Cisco ASA Series CLI Configuration Guide
Chapter 1 Configuring Inspection of Basic Internet Protocols
IPv6 Inspection
Detailed Steps
Examples
The following example creates an inspection policy map that will drop and log all IPv6 packets with the
hop-by-hop, destination-option, routing-address, and routing type 0 headers:
policy-map type inspect ipv6 ipv6-pm
parameters
match header hop-by-hop
Command Purpose
Step 1
policy-map type inspect ipv6 name
Example:
hostname(config)# policy-map type inspect
ipv6 ipv6-map
Creates an inspection policy map.
Step 2
match header header
[ drop [ log ] | log ]
Example:
hostname(config-pmap)# match header ah
hostname(config-pmap-c)# drop log
hostname(config-pmap-c)# match header esp
hostname(config-pmap-c)# drop log
Specifies the headers you want to match. By default, the packet is
logged (
log ); if you want to drop (and optionally also log) the
packet, enter the drop and optional log commands in match
configuration mode.
Re-enter the match command and optional drop action for each
extension you want to match:
•
ah —Matches the IPv6 Authentication extension header
•
count gt number —Specifies the maximum number of IPv6
extension headers, from 0 to 255
•
destination-option —Matches the IPv6 destination-option
extension header
•
esp —Matches the IPv6 Encapsulation Security Payload
(ESP) extension header
•
fragment —Matches the IPv6 fragment extension header
•
hop-by-hop —Matches the IPv6 hop-by-hop extension
header
•
routing-address count gt number —Sets the maximum
number of IPv6 routing header type 0 addresses, greater than
a number between 0 and 255
•
routing-type { eq | range } number —Matches the IPv6
routing header type, from 0 to 255. For a range, separate
values by a space, for example,
30 40 .
Step 3
parameters
[ no ] verify-header { order | type }
Example:
hostname(config-pmap)# parameters
hostname(config-pmap-p)# no verify-header
order
hostname(config-pmap-p)# no verify-header
type
Specifies IPv6 parameters. These parameters are enabled by
default. To disable them, enter the
no keyword.
•
[ no ] verify-header type —Allows only known IPv6
extension headers
•
[ no ] verify-header order —Enforces the order of IPv6
extension headers as defined in the RFC 2460 specification