Join Log in
Score:1
640KB avatar Server

Cisco ASA IPv6 single ::/64 prefix assignment

cn flag
640KB

I am configuring public IPv6 (dual stack w/static IPv4 block) on an ASA 5506 ver 9.9(2)36. The ISP has assigned a single /64 prefix where 2001:2:3:4::1 (not actual IP) is their equipment and 2001:2:3:4::2 could be our ASA. For a static IPv6 assignment I've typically seen the ISP provide a /126 block for our equipment with a routed /64 (or larger) for LAN devices. I have never configured an ASA with only a /64 before and it would seem like it would require both outside and inside interfaces to be on the same prefix, which of course isn't possible.

The LAN hosts correctly assign themselves the prefix and have the correct default route to the local link of the inside interface. I've tried assigning the /64 block IPv6 to the inside interface setting the default route on the outside interface to their router since I'm able to ping its local link from the local link on my outside interface. This doesn't work of course.

I have confirmed that their upstream routing is working as I am able to pass traffic from the ASA (traceroute out, ssh in) when the /64 is assigned to the outside interface.

Before I go back to them, I'm wondering if this configuration is even possible on an ASA (or otherwise)? It doesn't seem to me that this would work, however there is a lot of IPv6 voodoo that I don't completely understand.

Some config:

interface GigabitEthernet1/1
 security-level 0
 nameif outside
 ip address x.x.1.1 255.255.255.0
 ipv6 address 2001:2:3:4::2/64
 ipv6 enable
 ipv6 nd suppress-ra
!
interface GigabitEthernet1/2
 security-level 100
 nameif inside
 ip address 192.168.0.1 255.255.255.0
 ! ipv6 address 2001:2:3:4::3/64    ! this doesn't work of course
 ipv6 enable
 ipv6 nd prefix 2001:2:3:4::/64

ipv6 route outside ::/0 2001:2:3:4::1

Thanks!

59
0 + 0
Score:1
John Mahowald avatar Server
cn flag
John Mahowald

You are correct that a prefix is a /64. Makes routing easy.

Most address plans need more than one /64. One for each prefix you might use, LAN interface, security zone, test nets. A /48 is not unreasonable for a site, maybe a /56 for a small one.

CPE hosts addressed out of your delegated prefix is unusual. IPv6 has more than enough address space for the ISP gear to get some different address for itself. Or CPE might use link local addresses for itself, and not have any public IPs for its interfaces. In either case the delegated prefix is intended to be all yours.

Seems like a conversation with the ISP is in order.

0 + 0
640KB avatar
cn flag
640KB
Thanks, that was pretty much my thought as well, that the assignment of a single /64 is unnecessarily small. I did attempt to use the local link on the "outside" interface as ::/0 route to their side but had no success. I wasn't clear how not having a public IP on the outside interface of the ASA would work properly, in terms of outbound traffic originating from the ASA itself. Regardless I did go back to them and they assigned a /126 for CPE. My question was more theoretical, as in - could it actually work with an ASA or was it just not possible?
0
Reply
ธงชาติไทย
Elon Musk
I sit in a Tesla and translated this thread with Ai:

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.