IPv6 Support in the Classic IOS Firewall

Chapter 9, “Classic IOS Firewall Overview,” presented a detailed analysis of the Classic IOS Firewall, which was originally referred to as Context Based Access Control (CBAC). Chapter 12, “Application Inspection,” explored the application-level inspection capabilities available for this IOS Firewall approach. This section briefly covers the CBAC inspection resources for IPv6 environments, while reiterating that the Zone-base Policy Firewall (ZFW) is the recommended IOS firewall implementation model going forward.

Example 16-19 relates to the scenario shown in Figure 16-12. A policy called CBAC-IPV6 is defined to promote generic L4 inspection for UDP and TCP. Stateless ICMP filtering rules (represented by ACLs OUTBOUND and INBOUND) enable echo requests and replies through the IOS Firewall (between networks 2001:db8::/64 and 2001:db8:0:1111::/64).