If we use some of the same techniques
that we have with IPv4 standard and extended ACLs
by putting a deny IP any any at the very bottom
just see whether it got caught, that's
going to bite us with IPv6 filtering of traffic.
So in this video, I'd like to walk you
through the creation and verification of IPv6 access
control lists used for filtering.
And also share with you some of the defaults
that are built into those so that we don't automatically
just add a deny everything at the bottom, which will actually
destroy our IPv6 network. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
destroy our IPv6 network.
Let's take a look at our topology,
then we'll go right to the lab.
So here's our topology.
I've got IPv6 reachability already in place.
We're using this addressing scheme.
2001:DB8:6783 Then RR, which the router number is like 1234,
and so forth between them.
Also down here, I've got a web server.
It's at 2001:DB8:6783:8::100.
That's its IP address.
I also have a Windows 10 client up here
on this part of our network.
And this is the network 2001:DB8:6783. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And this is the network 2001:DB8:6783.
And this is just the one network all hanging off of R1
and whatever host generated IP address this client is using.
So here's I propose we do.
Let's create an IPv6 access list and set it up
for filtering outbound traffic right here on R4.
03/1.
Now before we actually implement this,
let me also share with you-- let me go to the big camera--
let me share with you the fact that by default, IPv6
relies on something called NDP, Neighbor Discovery Protocol. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
relies on something called NDP, Neighbor Discovery Protocol.
And it also uses ICMP.
If we do a hard coded deny any any for IPv6, that also could
prevent, if we have an inbound on an interface,
that would prevent those neighbor discovery messages
that we need to see.
So by default, in an access control list with IPv6,
if it's applied for filtering, it is allowing by default,
like the implied deny at the end,
right before that implied deny, there
is an implied permit of ICMP traffic
regarding neighbor solicitations and neighbor advertisements. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
regarding neighbor solicitations and neighbor advertisements.
So the key is, because implied near the end,
if you make a manual statement that says, deny ICMP any any,
you're basically going to kill those neighbor messages that
might try to come in on those interfaces
from other IPv6 speakers.
And it will break your network.
So that's a big difference between IPv4 access control
lists, which don't have an implied permit
anything, and IPv6, which is implying
allowing those neighbor solicitations and neighbor
advertisements.
So here in the lab, we'll go to R4, which is our target here. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So here in the lab, we'll go to R4, which is our target here.
And make sure we're on the right device.
Yep, R4.
And one of the key parts of troubleshooting
is making sure that we're not writing on top of an existing
access control list.
Let's take a look see what we have.
Show access-lists.
And that will show us all of our access lists, both IPv4
and IPv6.
Nothing there.
And let's go ahead and create an access control list for IPv6.
IPv6 access-list.
And let's go ahead and call it OUR6LIST in upper case. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And let's go ahead and call it OUR6LIST in upper case.
All right.
There we go.
You know what we should do?
Let's verify that our PC can actually get to the web server
down on that bottom right-hand side of the network.
So I'm going to bring up the client PC.
And let's go to a command prompt for a moment.
And let's do an IP config.
And sure enough, it's got IPv4 and IPv6 addresses.
So it's the one subnet for IPv6.
It's also the 0.1 subnet for IPv4. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
It's also the 0.1 subnet for IPv4.
I just wanted to confirm that.
Let's also confirm that we can get to the web server.
And that's going to be HTTP.
And there's the address.
2001:db8:6783:8::100.
I put that in brackets.
That way the browser doesn't think I'm
trying to go to a URL named that.
But rather, it's an IPv6 address.
And there it is.
I'm also going to click on Refresh just
to make sure we're really hitting that server.
It's not just cached.
All right.
Great. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Great.
So I'll close that.
Great.
And we can also ping that address 2001:db8--
[LAUGHTER]
DNS would be handy right now--
6783:8::100.
Yep.
OK.
So we have access, we have reachability
with ICMP and HTTP TCP port 80 going through the network.
All right.
Let's go and modify that with an access control list here on R4.
So in our access control list called
OUR6LIST, let's deny IPv6 traffic if it is-- WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
OUR6LIST, let's deny IPv6 traffic if it is--
in fact, let's go back a little bit.
So we have lots of options here regarding
what we want to match on, including the protocol number,
or IPv6 all IPv6, or ESP.
So we can be very granular if we want to, or ICMP.
So I'm going to say, deny, let's say TCP.
And this is going to be traffic from the subnet up where the PC
is, up off of R1, 2001:db8:6783:8: WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
is, up off of R1, 2001:db8:6783:8:
the 1 subnet colon, colon.
Oh, this is a great thing.
Oh, my gosh.
So good.
Because we don't have to deal with wildcard masks
in an access control list for IPv6.
If we want to point to that network, we just do /64.
And it says, great, I get it.
That's the first 64 bits I need to match on.
No need to do wildcard masks.
All right.
So that's the source.
Deny TCP coming from that subnet where the PC is.
And let's destin it to the actual host,
the 128-bit address of the server, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
the 128-bit address of the server,
which is 2001:db8:6783:8::100.
That's the address we pinged just a moment ago.
And I'm also going to go ahead and log that for good measure.
And let's also deny ICMP traffic.
So we can hit the Up arrow key, do a Control-A.
One of the tricky things is, that with Windows
or with computers in general, with IPv6
they can have multiple IPv6 addresses
and they can rotate those. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and they can rotate those.
So as far as doing it from a specific source IPv6 address,
that may change.
Or the client may use a different source address.
So just be aware of that.
That that's not always a fixed hard constant
when a client with multiple IPv6 addresses,
like my Windows 10 computer has, is going to source it.
So we'll just do a deny ICMP traffic from the same subnet,
2001:db8:6783:1, 64-bit mask, going to that same server.
And at the end, oh, oh. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And at the end, oh, oh.
Let's do a do show.
Let's do our troubleshooting part right now.
Do show access-list.
I intended to put an equal to the TCP port of 80.
I failed to.
So this is going to block all TCP traffic, which
is fine, as well.
So it's all TCP traffic coming from that subnet going
to that host, all ICMP traffic going to that host.
So if you and I tried that same technique for doing like this,
deny IPv6 any any, then if we did this WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
deny IPv6 any any, then if we did this
and if this access list was applied inbound,
it would deny neighbor solicitations, which
are permitted by default. And because it's not
going to apply to outbound traffic on that router,
it'd be fine.
However, I just realized that we need to permit here
or nothing is going to work.
So let's go ahead and permit everything else.
Permit IPv6 and any log.
And let's do a show command.
All right.
So now if we apply this to our outbound interface--
let's take a look at our diagram here--
on R4 serial 3/1, in an outbound direction, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
on R4 serial 3/1, in an outbound direction,
then it would deny TCP traffic coming from that subnet going
to that host.
It would deny ICMP traffic coming
from that subnet going to that host.
And it would permit everything else.
And it would also log it.
I think we're good to go.
Let's go ahead and go to the interface.
Interface serial 3/1.
And to apply it, it's IPv6.
The syntax is traffic-filter, which makes a lot of sense.
So IPv6 traffic-filter and then the name of our access list,
which I'm going to scroll up a little bit for. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
which I'm going to scroll up a little bit for.
It is called OUR6LIST.
It's going to copy that name and paste it.
And then it's going to ask us how do you want to apply this?
For traffic coming in or routed traffic that's trying to leave?
And we want it to be outbound.
So we can do a show access list to see
what's in the access list.
Then we do a show IPv6 interface, or serial 3/1,
and press Enter.
And that would give us a lot of information
about that interface, including the global address
on that interface, the link local address
on that interface, the multicast groups it's joined. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
on that interface, the multicast groups it's joined.
And so here we have FF02::5, which means, hey,
this guy's running OSPF because that's the multicast group
for OSPF.
And outgoing access list is OUR6LIST.
That way we can verify it's applied.
So if we go back to our client now, and let's
send some traffic.
If we do a ping--
now I wasn't expecting that to work.
Why is that working?
Let's go to the--
I thought we denied that. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
I thought we denied that.
Let's check it out.
This is our troubleshooting section.
Let's go to R1.
Let's take a look at our routes.
Show IPv6 route for--
let's look at all of them.
And we're looking for the 8 network, which is right here.
And it's going out gig 1/0, which in our topology
is going out here to R2.
And why is that being permitted outbound on R4?
Hmm.
Let's go take a look at R4.
Let's go ask him. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Let's go ask him.
I'm literally curious here.
So on R4, do a show access list.
And here we have some matches on that.
Look at that.
That's the only matches we have.
Deny ICMP 2001:DB8:6731 going to that host, 2001:DB8.
It says denies, but we got answers.
Hmm,
We did get responses, right?
And I also have the permit here, which
is permitting everything else.
And there's no matches there. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And there's no matches there.
Let's do this.
Let's go ahead and go to R1.
And let's do a ping.
And let's do IPv6.
And the target address is going to be--
I'm going to grab part of it right here.
:100.
And the repeat count's fine.
Datagram fine.
Extended commands?
Yes.
And we're going to source it from our interface.
Let's see here. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Let's see here.
This guy right there.
That's his address on the 1 subnet.
So I'll paste that in.
UDP protocol?
And I'm just going to take the defaults here.
[LAUGHTER]
Success rate zero.
And that's what I would expect.
I would expect them all to be denied.
If we go back to R4 and we do a show access-lists, sure enough,
there's the five additional pings that were denied. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
there's the five additional pings that were denied.
And so we didn't get responses.
So hmm.
[LAUGHTER]
How is the PC thinking he got responses unless there's
some kind of a proxy response?
So how is the PC getting response messages back?
I'm curious.
It may be just a lab thing.
Let's do it one more time.
I'm going to do a ping.
And that should be 1, 2, 3, 4.
And our previous count was nine.
So if it goes to 13 on the deny-- WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So if it goes to 13 on the deny--
[LAUGHTER]
Well, R4 says it's doing its job.
And the fact that that PC is saying,
you know, it looks good to me is curious.
I'll have to investigate that.
But this access list is indeed killing it.
Those packets are not being rounded further than R4.
So we can go back to the R1.
And let's go ahead and do a ping again from here.
And let's go to this address.
But this time, he's going to source it from the interface WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
But this time, he's going to source it from the interface
from his routing table that's closest.
And there shouldn't be any limits there.
There we go.
Five ping out of five.
So if we go back to our counters on R4--
so a moment ago, there we go.
It says permitted.
Great.
And there's our source address that was permitted.
Fantastic.
So if we hit the the Up arrow key for show access lists,
there we have our five pings that
matched and were forwarded.
All right.
So I have a little investigating to do.
Why the PC believes--
So in situations like that, in troubleshooting,
I might get out a protocol analyzer WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
I might get out a protocol analyzer
and stick it on the network between the PC and the router
and say, what's going on?
Is somebody proxying responses back to you
because those packets we're not making it down there?
All right.
So that's all part of the troubleshooting game.
So the key elements I want you to take away
from this video and the hands-on lab
is the fact that access control lists for IPv6
can be used for filtering.
And they also include by default near the bottom,
before the implicit deny any, they
have the permit of ICMP traffic for neighbor solicitation
and neighbor discovery.
If we put an explicit deny at the end for all IPv6 traffic, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
If we put an explicit deny at the end for all IPv6 traffic,
or somewhere earlier in the list a deny for all ICMP traffic,
and I supply it inbound on an interface,
that's going to harm our neighbor discovery
process with IPv6.
So thanks for joining me in this video and hands-on lab.
In the next video, we get to take a look
at the configuration and use of unicast reverse path
forwarding on a Cisco router.
It's a pretty cool security feature.
And you'll have a firsthand opportunity
to both see it, practice it, and verify in the lab.
So we'll see you in that next video in just a moment. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So we'll see you in that next video in just a moment.
Meanwhile, I hope this has been informative for you.
And I'd like to thank you for viewing.