IPv6 Ahoy!

Recently, I decided to embrace IPv6 instead of being scared of it. Yes, it can be daunting at first, but once you get the hang of it, it isn't bad at all. Actually, because of its design, IPv6 is easier to work with. Router Advertisements, a smaller header, and the biggie, eui-64, make IPv6 configuration much easier.

Here's the coolest part of it all: I have a /48 IPv6 block of addresses!

That's right. I signed up for an IPv6 tunnel via tunnelbroker.net (provided by Hurricane Electric) and asked for a /48. With the IPv6 tunnel, I can use IPv6 and really get a feel for it. That's my theory: If you want to get to know something, spend time with it. The best way to learn about IPv6 is to make it work on your devices.

I'm not going to go into detail about tunnel configuration, unless someone asks, because most of the information is available at tunnelbroker.net after you sign up for a tunnel.

Be warned though: If you configure an IPv6 tunnel into your network without any additional security you will be exposing your IPv6 connected clients to the the public IPv6 world. Your IPv4 firewall won't stop traffic destined for your IPv6 hosts because it is tunnelled. IPv6 traffic will just flow right past your firewall into your network.

To secure my IPv6 deployment I configured a reflexive access-list on my tunnel interface. It isn't the best security, but it works pretty well for me.

Something you may want to do is add a separate ACL entry for outgoing DNS with a small timeout. I set my DNS timeout to 15 seconds so that DNS queries wouldn't leave ports open for the default timeout of 300 seconds, or five minutes. Usually, TCP ACL entries will be removed 5 seconds after two FIN bits are detected (see here). DNS uses UDP, which is connectionless and does not have the concept of a session. Because there is no way to determine if a UDP session is being used or is idle (at least, not in a reflexive ACL), we set the timeout to 15 seconds and let the DNS ACL entries timeout by themselves.

Here are the pertinent parts of the configuration on my Cisco 2621:

 interface Tunnel0  
  description HE IPv6  
  bandwidth 6000  
  no ip address  
  ip mtu 1472  
  load-interval 30  
  ipv6 address 2001:<Address>/64  
  ipv6 enable  
  ipv6 traffic-filter EXTERIOR-INv6 in  
  ipv6 traffic-filter EXTERIOR-OUTv6 out  
  tunnel source FastEthernet0/1  
  tunnel destination <Address>  
  tunnel mode ipv6ip  
 !  
 ip nat inside source static tcp 172.30.1.101 80 interface FastEthernet0/1 80  
 ip nat inside source static tcp 172.30.1.102 22 interface FastEthernet0/1 22  
 !  
 ip route 0.0.0.0 0.0.0.0 192.168.1.1  
 !  
 ip access-list standard TELNETv4  
  permit 10.0.0.0 0.255.255.255  
  permit 172.16.0.0 0.15.255.255  
  permit 192.168.0.0 0.0.255.255  
 !  
 ipv6 route ::/0 Tunnel0  
 !  
 ipv6 access-list EXTERIOR-INv6  
  evaluate EXTERIOR-REFLECTv6  
  permit tcp any host 2001:<Server1> eq www  
  permit tcp any host 2001:<Server2> eq www  
  permit tcp any host 2001:<Server2> eq 22  
  permit icmp any any  
  deny ipv6 any any log  
 !  
 ipv6 access-list EXTERIOR-OUTv6  
  sequence 5 permit udp 2001:<Address>/48 any eq domain reflect EXTERIOR-REFLECTv6 timeout 15  
  sequence 10 permit ipv6 2001:<Address>/48 any reflect EXTERIOR-REFLECTv6  
 !  
 ipv6 access-list TELNETv6  
  permit ipv6 FE80::/16 any  
  permit ipv6 2001:<Address>/48 any  
  deny ipv6 any any log  
 !  
 line con 0  
  exec-timeout 0 0  
  transport preferred none  
 line aux 0  
 line vty 0 4  
  access-class TELNETv4 in  
  exec-timeout 0 0  
  ipv6 access-class TELNETv6 in  
  login local  
 line vty 5 15  
  access-class TELNETv4 in  
  exec-timeout 0 0  
  ipv6 access-class TELNETv6 in
  login local