Cisco 5505 - ASA Firewall Edition Bundle, Руководство по настройке CLI

Страница: 733 / 2164

1-5
Cisco ASA Series CLI Configuration Guide
Chapter 1 Configuring IPv6 Neighbor Discovery
Guidelines and Limitations
•
By default, prefixes configured as addresses on an interface using the ipv6 address command are
advertised in router advertisements. If you configure prefixes for advertisement using the ipv6 nd
prefix command, then only these prefixes are advertised.
•
The default keyword can be used to set default parameters for all prefixes.
•
A date can be set to specify the expiration of a prefix. The valid and preferred lifetimes are counted
down in real time. When the expiration date is reached, the prefix will no longer be advertised.
•
When onlink is on (by default), the specified prefix is assigned to the link. Nodes sending traffic to
such addresses that contain the specified prefix consider the destination to be locally reachable on
the link.
•
When autoconfig is on (by default), it indicates to hosts on the local link that the specified prefix
can be used for IPv6 autoconfiguration.
•
For stateless autoconfiguration to work correctly, the advertised prefix length in router
advertisement messages must always be 64 bits.
•
The router lifetime value is included in all IPv6 router advertisements sent out of the interface. The
value indicates the usefulness of the ASA as a default router on this interface.
•
Setting the value to a non-zero value indicates that the ASA should be considered a default router
on this interface. The non-zero value for the router lifetime value should not be less than the router
advertisement interval.
The following guidelines and limitations apply for configuring a static IPv6 neighbor:
•
The ipv6 neighbor command is similar to the arp command. If an entry for the specified IPv6
address already exists in the neighbor discovery cache—learned through the IPv6 neighbor
discovery process—the entry is automatically converted to a static entry. These entries are stored in
the configuration when the copy command is used to store the configuration.
•
Use the show ipv6 neighbor command to view static entries in the IPv6 neighbor discovery cache.
•
The clear ipv6 neighbor command deletes all entries in the IPv6 neighbor discovery cache except
static entries. The no ipv6 neighbor command deletes a specified static entry from the neighbor
discovery cache; the command does not remove dynamic entries—entries learned from the IPv6
neighbor discovery process—from the cache. Disabling IPv6 on an interface by using the
no ipv6
enable command deletes all IPv6 neighbor discovery cache entries configured for that interface
except static entries (the state of the entry changes to INCMP [Incomplete]).
•
Static entries in the IPv6 neighbor discovery cache are not modified by the neighbor discovery
process.
•
The clear ipv6 neighbor command does not remove static entries from the IPv6 neighbor discovery
cache; it only clears the dynamic entries.
•
The ICMP syslogs generated are caused by a regular refresh of IPv6 neighbor entries. The ASA
default timer for IPv6 neighbor entry is 30 seconds, so the ASA would generate ICMPv6 neighbor
discovery and response packets about every 30 seconds. If the ASA has both failover LAN and state
interfaces configured with IPv6 addresses, then every 30 seconds, ICMPv6 neighbor discovery and
response packets will be generated by both ASAs for both configured and link-local IPv6 addresses.
In addition, each packet will generate several syslogs (ICMP connection and local-host creation or
teardown), so it may appear that constant ICMP syslogs are being generated. The refresh time for
IPV6 neighbor entry is configurable on the regular data interface, but not configurable on the
failover interface. However, the CPU impact for this ICMP neighbor discovery traffic is minimal.