I have a bit of a problem with my Cisco 1921 ISR config. I have ipv4 (obviously) and also native ipv6 connectivity in my home lab. I am trying to set up the zone based firewall. With ipv4 traffic, the returning traffic is matched fine and can come thru (that's how I'm uploading this question). But with ipv6, I can see just half traffic. Outgoing traffic is matched and let out fine, the returning traffic inexplicably gets matched with the class-default and gets dropped. That is what I want to fix. I know that when doing zone based firewall, the policy class should always match just one stack v4 XOR v6.

Just a side-note. I am doing this for my home networking setup. I know having a cisco router is not meant to be for the home environment, but I like it. I like geeking over tech and learning new things. Plus I almost forgot everything from my CCNA about 10 years ago. Thanks for your help guys.

So here's my config ...

I have two zones, INTERNET and TRUSTED (well there's more but for this setup I'm focusing just on those two). Internet has a link-local fe80:: address and the ISP sends my entire /56 to that address. Without the firewall, ipv6 works fine.

vrf definition VRF1
 address-family ipv6
ipv6 unicast-routing
ipv6 cef
parameter-map type inspect ipv6-param-map
 ipv6 routing-header-enforcement loose
 sessions maximum 10000
class-map type inspect match-any TRUSTED-TO-INTERNET-6-CLASS
 match access-group name TRUSTED-TO-INTERNET-6-ACL
class-map type inspect match-any TRUSTED-TO-INTERNET-CLASS
 match protocol tcp
 match protocol udp
 match protocol icmp
policy-map type inspect TRUSTED-TO-INTERNET-POLICY
 class type inspect TRUSTED-TO-INTERNET-CLASS
 class type inspect TRUSTED-TO-INTERNET-6-CLASS
  inspect ipv6-param-map
 class class-default
  drop log
zone security TRUSTED
zone security INTERNET
zone-pair security TRUSTED-TO-INTERNET source TRUSTED destination INTERNET
 service-policy type inspect TRUSTED-TO-INTERNET-POLICY
ipv6 access-list TRUSTED-TO-INTERNET-6-ACL
 permit ipv6 any any

And now what is really happening:

moe#sh log
Feb  8 19:15:14.769: %FW-6-DROP_PKT: Dropping tcp session [2A01:<my_laptop's_ipv6>]:61984 [2A00:1450:4009:800::2004]:80 on zone-pair TRUSTED-TO-INTERNET class class-default due to  DROP action found in policy-map with ip ident 0

So from that I think the traffic does not get matched by my policy classes

moe#show policy-map type inspect zone-pair TRUSTED-TO-INTERNET sessions

policy exists on zp TRUSTED-TO-INTERNET

  Service-policy inspect : TRUSTED-TO-INTERNET-POLICY

    Class-map: TRUSTED-TO-INTERNET-CLASS (match-any)
      Match: protocol tcp
        6348 packets, 322834 bytes
        30 second rate 0 bps
      Match: protocol udp
        1890 packets, 100760 bytes
        30 second rate 0 bps
      Match: protocol icmp
        12 packets, 288 bytes
        30 second rate 0 bps


      Number of Established Sessions = 46
      Established Sessions
        Session 2D39D100 (<laptop's_ipv4>:50415)=>( tcp SIS_OPEN/TCP_ESTAB
          Created 12:02:12, Last heard 00:00:03
          Bytes sent (initiator:responder) [87580:124570]

< ...
  ... >

      Number of Half-open Sessions = 3
      Half-open Sessions
        Session 2D3A4B80 [2A01:<laptop_ipv6>]:128=>[2A00:1450:4009:807::200E]:0 icmpv6 SIS_OPENING
          Created 00:20:54, Last heard 00:00:00
          ECHO request
          Bytes sent (initiator:responder) [10008:0]
        Session 2D39CA00 [2A01:<laptop_ipv6>]:55263=>[2A01:578:3::34D7:905B]:443 tcp SIS_OPENING/TCP_SYNSENT
          Created 00:00:28, Last heard 00:00:28
          Bytes sent (initiator:responder) [0:0]
        Session 2D3A4800 [2A01:<laptop_ipv6>]:46727=>[2A01:578:3::3431:3FD0]:443 tcp SIS_OPENING/TCP_SYNSENT
          Created 00:00:19, Last heard 00:00:19
          Bytes sent (initiator:responder) [0:0]

    Class-map: TRUSTED-TO-INTERNET-6-CLASS (match-any)
      Match: protocol tcp
        0 packets, 0 bytes
        30 second rate 0 bps
      Match: protocol udp
        0 packets, 0 bytes
        30 second rate 0 bps
      Match: protocol icmp
        0 packets, 0 bytes
        30 second rate 0 bps
      Match: access-group name TRUSTED-TO-INTERNET-6-ACL
        0 packets, 0 bytes
        30 second rate 0 bps


    Class-map: class-default (match-any)
      Match: any
        18961 packets, 961301 bytes

Any ideas why my returning traffic gets shot down by class-default instead of matching as the returning traffic just like it does with ipv4?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.