Configures IPv6 components on this firewall policy
ipv6 [dos|duplicate-options|firewall|option|rewrite-flow-label|routing-type| strict-ext-hdr-check|unknown-options]
ipv6 dos {hop-limit-zero|multicast-icmpv6|tcp-intercept-mobility} [drop-only|
log-and-drop|log-only]
ipv6 [duplicate-options|routing-type [one|two]|strict-ext-hdr-check|unknown-options] [drop-only|log-and-drop|log-only]
ipv6 option {endpoint-identification|network-service-access-point|router-alert|
strict-hao-opt-alert|strict-padding} [drop-only|log-and-drop|log-only]
ipv6 [firewall enable|rewrite-flow-label]
ipv6 dos {hop-limit-zero|multicast-icmpv6|tcp-intercept-mobility}
[drop-only|log-and-drop|log-only]
| dos | Identifies IPv6 events as DoS events |
| hop-limit-zero | Optional. Enables checking of IPv6 hop limit field. If the IPv6 hop limit field is ZERO (0) it is considered as attack. This option is enabled by default. |
| multicast-icmpv6 | Optional. Enables detection of multicast ICMPv6 traffic as attack. This option is applicable only to ICMPv6 Echo request or reply packets. This option is enabled by default. |
| tcp-intercept-mobility | Optional. Enables detection of IPv6 TCP packets with mobility option "HAO(Home-Address-Option)" or "RH(Routing Header) type two". When enabled, this option also detects the “don't generate TCP syn cookies” for such packets. This option is enabled by default. |
| drop-only | This parameter is common to all of the above keywords.
Drops all packets. Drops the specified packet type (hop-limit-zero, multicast-icmpv6, and tcp-intercept-mobility). |
| log-and-drop | Logs the event and drops the packet. Drops the specified packet type (hop-limit-zero, multicast-icmpv6, and tcp-intercept-mobility) and logs an event. |
| log-only | Logs the event only, the packet is not dropped. Does not drop the specified packet type (hop-limit-zero, multicast-icmpv6, and tcp-intercept-mobility). But, an event is logged. |
| log-level | If selecting the “log-and-drop” and “log-only” action
type, specify the log level. The options are:
|
ipv6 [duplicate-options|routing-type [one|two]|strict-ext-hdr-check|unknown-options] [drop-only|log-and-drop|log-only]
| duplicate-options | Enables handling of duplicate options in hop-by-hop and destination option extension headers. This configuration excludes HAO handling. This option is enabled by default. |
| routing-type [one|two] | Enables checking of the following IPv6 routing types:
|
| strict-ext-hdr-check | Enables strict checking for out of order and number of occurrences of extension header. This option is enabled by default. |
| unknown-options | Enables handling unknown options in hop-by-hop and destination option extension headers. This option is enabled by default. |
| drop-only | This parameter is common to all of the above keywords. Drops all packets. Drops the packet if matching any of the above specified types. |
| log-and-drop | Logs the event and drops the packet. Drops the packet, if matching any of the above specified types, and logs an event. |
| log-only | Logs the event only, the packet is not dropped. Does not drop the packet, if matching any of the above specified types. But an event is logged. |
| log-level | If selecting the “log-and-drop” and “log-only” action type, specify the log
level. The options are:
|
ipv6 option {endpoint-identification|network-service-access-point|router-alert|
strict-hao-opt-alert|strict-padding} [drop-only|log-and-drop|log-only
| option | Enables checking for the following ipv6 extension header options:
All of these are optional parameters. If no option is specified, the system enables checks as per the default values. |
| drop-only | This parameter is common to all of the above keywords. Drops all packets. Drops the packet if matching any of the above specified “option” types. |
| log-and-drop | Logs the event and drops the packet. Drops the packet, if matching any of the above specified “option” types, and logs an event. |
| log-only | Logs the event only, the packet is not dropped. Does not drop the packet, if matching any of the above specified “option” types. But an event is logged. |
| log-level | If selecting the “log-and-drop” and “log-only” action type, specify the log
level. The options are:
|
ipv6 [firewall enable|rewrite-flow-label]
| firewall enable | Enables IPv6 firewall. This option is enabled by default. |
| rewrite-flow-label | Rewrites the IPv6 flow label field of every packet. This option is disabled by default. |
nx9500-6C8809(config-fw-policy-testFW)#ipv6 dos hop-limit-zero drop-only
nx9500-6C8809(config-fw-policy-testFW)#ipv6 routing-type two log-and-drop log-level warnings
nx9500-6C8809(config-fw-policy-testFW)#show context firewall-policy testFW ip dos fraggle drop-only ip dos tcp-sequence-past-window drop-only ip dos tcp-max-incomplete high 600 ip dos tcp-max-incomplete low 60 ip-mac conflict drop-only ip-mac routing conflict log-and-drop log-level notifications flow timeout icmp 16000 flow timeout udp 10000 flow timeout tcp established 1500 flow timeout other 16000 dhcp-offer-convert ipv6 routing-type two log-and-drop log-level warnings ipv6 dos hop-limit-zero drop-only alg facetime dns-snoop entry-timeout 1200 nx9500-6C8809(config-fw-policy-testFW)#
| no | Resets this firewall policy‘s IPv6 components |