I have a bit of a problem with my Cisco 1921 ISR config. I have ipv4 (obviously) and also native ipv6 connectivity in my home lab. I am trying to set up the zone based firewall. With ipv4 traffic, the returning traffic is matched fine and can come thru (that's how I'm uploading this question). But with ipv6, I can see just half traffic. Outgoing traffic is matched and let out fine, the returning traffic inexplicably gets matched with the class-default and gets dropped. That is what I want to fix. I know that when doing zone based firewall, the policy class should always match just one stack v4 XOR v6.
Just a side-note. I am doing this for my home networking setup. I know having a cisco router is not meant to be for the home environment, but I like it. I like geeking over tech and learning new things. Plus I almost forgot everything from my CCNA about 10 years ago. Thanks for your help guys.
So here's my config ...
I have two zones, INTERNET and TRUSTED (well there's more but for this setup I'm focusing just on those two). Internet has a link-local
fe80:: address and the ISP sends my entire /56 to that address. Without the firewall, ipv6 works fine.
vrf definition VRF1 ! address-family ipv6 exit-address-family ! ipv6 unicast-routing ! ipv6 cef ! parameter-map type inspect ipv6-param-map ipv6 routing-header-enforcement loose sessions maximum 10000 class-map type inspect match-any TRUSTED-TO-INTERNET-6-CLASS match access-group name TRUSTED-TO-INTERNET-6-ACL class-map type inspect match-any TRUSTED-TO-INTERNET-CLASS match protocol tcp match protocol udp match protocol icmp ! policy-map type inspect TRUSTED-TO-INTERNET-POLICY class type inspect TRUSTED-TO-INTERNET-CLASS inspect class type inspect TRUSTED-TO-INTERNET-6-CLASS inspect ipv6-param-map class class-default drop log ! zone security TRUSTED zone security INTERNET ! zone-pair security TRUSTED-TO-INTERNET source TRUSTED destination INTERNET service-policy type inspect TRUSTED-TO-INTERNET-POLICY ! ipv6 access-list TRUSTED-TO-INTERNET-6-ACL permit ipv6 any any
And now what is really happening:
moe#sh log <omitted> Feb 8 19:15:14.769: %FW-6-DROP_PKT: Dropping tcp session [2A01:<my_laptop's_ipv6>]:61984 [2A00:1450:4009:800::2004]:80 on zone-pair TRUSTED-TO-INTERNET class class-default due to DROP action found in policy-map with ip ident 0
So from that I think the traffic does not get matched by my policy classes
moe#show policy-map type inspect zone-pair TRUSTED-TO-INTERNET sessions policy exists on zp TRUSTED-TO-INTERNET Zone-pair: TRUSTED-TO-INTERNET Service-policy inspect : TRUSTED-TO-INTERNET-POLICY Class-map: TRUSTED-TO-INTERNET-CLASS (match-any) Match: protocol tcp 6348 packets, 322834 bytes 30 second rate 0 bps Match: protocol udp 1890 packets, 100760 bytes 30 second rate 0 bps Match: protocol icmp 12 packets, 288 bytes 30 second rate 0 bps Inspect Number of Established Sessions = 46 Established Sessions Session 2D39D100 (<laptop's_ipv4>:50415)=>(184.108.40.206:4070) tcp SIS_OPEN/TCP_ESTAB Created 12:02:12, Last heard 00:00:03 Bytes sent (initiator:responder) [87580:124570] < ... ... omitted ... ... > Number of Half-open Sessions = 3 Half-open Sessions Session 2D3A4B80 [2A01:<laptop_ipv6>]:128=>[2A00:1450:4009:807::200E]:0 icmpv6 SIS_OPENING Created 00:20:54, Last heard 00:00:00 ECHO request Bytes sent (initiator:responder) [10008:0] Session 2D39CA00 [2A01:<laptop_ipv6>]:55263=>[2A01:578:3::34D7:905B]:443 tcp SIS_OPENING/TCP_SYNSENT Created 00:00:28, Last heard 00:00:28 Bytes sent (initiator:responder) [0:0] Session 2D3A4800 [2A01:<laptop_ipv6>]:46727=>[2A01:578:3::3431:3FD0]:443 tcp SIS_OPENING/TCP_SYNSENT Created 00:00:19, Last heard 00:00:19 Bytes sent (initiator:responder) [0:0] Class-map: TRUSTED-TO-INTERNET-6-CLASS (match-any) Match: protocol tcp 0 packets, 0 bytes 30 second rate 0 bps Match: protocol udp 0 packets, 0 bytes 30 second rate 0 bps Match: protocol icmp 0 packets, 0 bytes 30 second rate 0 bps Match: access-group name TRUSTED-TO-INTERNET-6-ACL 0 packets, 0 bytes 30 second rate 0 bps Inspect Class-map: class-default (match-any) Match: any Drop 18961 packets, 961301 bytes
Any ideas why my returning traffic gets shot down by class-default instead of matching as the returning traffic just like it does with ipv4?