Working with routers and switches everyday on my daytime job it is certainly interesting when it comes to configuring IPv6 on my homebase in Boxtel / The Netherlands. On my job i implemented ISP-wide IPv6 on services we deliver like fiber, DSL, colocation and other stuff and now it’s time to do what every geek on this planet should do. Get your sweet IPv6 /48 block and configure the darn thing 
.
At home i use a Cisco 877 ADSL router with the advanced-ip-services IOS software on it. While the Cisco 800-series routers are quite good, it’s insane that Cisco wants an extra $$$ for the IOS software with IPv6. It definitely should be a default in all CPE devices. On the other hand, Cisco is one of the few with a very nice IPv6 implementation ready whereas other (Chinese, Taiwanese…) vendors only have half of it or none at all. It’s pathetic!
If you want more information on IPv6 i can really recommend you the book by Iljitsch van Beijnum named Running IPv6 which contains all the gory details on every aspect IPv6 has to offer. After reading the book you will notice that IPv6 is definitely not rocket science and it’s very easy to implement.
This is what i want on an IPv6 setup :
- A /48 block of global IPv6 addresses
- Router-advertisements on the LAN so i don’t have to configure them by hand
- A firewall on my router
A firewall? Yes! There’s no NAT anymore with IPv6, so every PC on your LAN gets a public routable IPv6 address which is great but without a decent firewall it’s a potential security risk. Especially because of the different (crappy) firewall implementations on various operating systems (Windows, Mac OS X) we really want this to be done on the router just like a NAT router blocks all incoming and passes all outgoing. I know that you cannot compare a NAT router with a firewall but for the sake of simplicity this is the way it’s going to be.
On the Cisco i have an ADSL line, configured with PPP-over-ATM. I cannot do native IPv6 on the thing right now because i have been pretty lazy on reconfiguring my own DSL line . For now, i’m tunneling IPv6 through a GRE tunnel over IPv4 to a tunnel endpoint at my job premises.
The actual Cisco configuration for the network and routing connections :
ipv6 unicast-routing
This is mandatory! Without this, the Cisco will not do any routing on IPv6
ipv6 cef
interface tunnel1
no ip address
ipv6 address 2001:4fff:5:1::1:1/126
ipv6 enable
tunnel source
tunnel destination
!
interface Vlan1
ipv6 address 2001:4fff:4::1/64
ipv6 enable
ipv6 nd prefix 2001:4fff:4::/64
ipv6 nd advertisement-interval
ipv6 nd ra interval 4
!
The latter command (ipv6 nd ra interval 4) fixed an annoying problem i had with one of the Windoof Vista hosts on the network.
Alright! We have a running IPv6 configuration with router-advertisements (ipv6 nd) sending to my clients. This way all my clients will have a working IPv6 configuration ready to use.
BUT.. You’re not finished just yet..
Do not forget the firewall step
ipv6 inspect name traffic tcp
ipv6 inspect name traffic udp
ipv6 inspect name traffic ftp
ipv6 inspect name traffic icmp
!
interface tunnel1
ipv6 traffic-filter tu1-in in
ipv6 traffic-filter tu1-out out
!
ipv6 access-list tu1-in
permit icmp any any echo-request
permit icmp any any echo-reply
permit tcp 2001:4fff::/32 any eq 22
evaluate reflectout
deny ipv6 any any log-input
!
ipv6 access-list tu1-out
permit icmp any any echo-reply
permit icmp any any echo-request
permit tcp any any reflect reflectout
permit udp any any reflect reflectout
deny ipv6 any any log-input
!
As you can see, this is a stateful firewall configuration on an IOS device. The reflect rule creates the state and the evaluate (in tu1-in) tries to find a match on the reflect rule. For this to work i found out i needed the ipv6 inspect rules.
And that’s about it! If you have real native-IPv6 on your ethernet router this will even be more easy.
That’s it for today. If you have any comments or things to add, please leave a comment. Awareness for IPv6 is key at this moment!
en vervolgens verder naar “Sin City” oftewel Las Vegas!
