47-50
Cisco ASA 5500 Series Configuration Guide using ASDM
Chapter47 Configuring Inspection of Basic Internet Protocols
IPv6 Inspection
IPv6 Inspection
You can configure IPv6 Inspection by using MPF rules to selectively block IPv6 traffic based on the
extension header. IPv6 packets are subjected to an early security check. The ASA always passes
hop-by-hop and destination option types of extension headers while blocking router header and no next
header.
You can enable default IPv6 inspection or define IPv6 inspection. By defining an MPF policy map for
IPv6 inspection you can configure the ASA to selectively drop IPv6 packets based on following types of
extension headers found anywhere in the IPv6 packet:
•Hop-by-Hop Options
•Routing (Type 0)
•Fragment
•Destination Options
•Authentication
•Encapsulating Security Payload
In addition, default IPv6 inspection checks conformance to RFC 2460 for type and order of extension
headers in IPv6 packets:
•IPv6 header
•Hop-by-Hop Options header (0)
•Destination Options header (60)
•Routing header (43)
•Fragment header (44)
•Authentication (51)
•Encapsulating Security Payload header(50)
•Destination Options header (60)
•No Next Header (59)
When a policy map is not configured for IPv6inspection or a configured policy map is not associated
with an interface, the ASA drops packets with any mobility type and a routing-type IPv6 extension
header that arrive at the interface.
When an IPv6 inspection policy map is created, the ASA automatically generates a configuration to drop
packets that match header routing-type in the range 0-255.

Configuring an IPv6 Inspection Policy Map

You can configure a policy map for IPv6 inspection to handle IPv6 extension headers. The IPv6 policy
map is applied to each classified IPv6 packet on the specified direction. Currently, only incoming IPv6
traffic is inspected.
Step1 Choose Configuration > Firewall > Objects > Inspect Maps > IPv6. The Configure IPv6 Maps pane
appears.
Step2 Click Add. The Add IPv6 Inspection Map dialog box appears.
Step3 Enter a name and description for the inspection map.