Cisco ISR Zone Based Firewall dual stack not matching returning traffic for ipv6

Question

I have a bit of a problem with my Cisco 1921 ISR config. I have ipv4 (obviously) and also native ipv6 connectivity in my home lab. I am trying to set up the zone based firewall. With ipv4 traffic, the returning traffic is matched fine and can come thru (that's how I'm uploading this question). But with ipv6, I can see just half traffic. Outgoing traffic is matched and let out fine, the returning traffic inexplicably gets matched with the class-default and gets dropped. That is what I want to fix. I know that when doing zone based firewall, the policy class should always match just one stack v4 XOR v6.

Just a side-note. I am doing this for my home networking setup. I know having a cisco router is not meant to be for the home environment, but I like it. I like geeking over tech and learning new things. Plus I almost forgot everything from my CCNA about 10 years ago. Thanks for your help guys.

So here's my config ...

I have two zones, INTERNET and TRUSTED (well there's more but for this setup I'm focusing just on those two). Internet has a link-local fe80:: address and the ISP sends my entire /56 to that address. Without the firewall, ipv6 works fine.

vrf definition VRF1
 !
 address-family ipv6
 exit-address-family
!
ipv6 unicast-routing
!
ipv6 cef
!
parameter-map type inspect ipv6-param-map
 ipv6 routing-header-enforcement loose
 sessions maximum 10000
class-map type inspect match-any TRUSTED-TO-INTERNET-6-CLASS
 match access-group name TRUSTED-TO-INTERNET-6-ACL
class-map type inspect match-any TRUSTED-TO-INTERNET-CLASS
 match protocol tcp
 match protocol udp
 match protocol icmp
!
policy-map type inspect TRUSTED-TO-INTERNET-POLICY
 class type inspect TRUSTED-TO-INTERNET-CLASS
  inspect
 class type inspect TRUSTED-TO-INTERNET-6-CLASS
  inspect ipv6-param-map
 class class-default
  drop log
!
zone security TRUSTED
zone security INTERNET
!
zone-pair security TRUSTED-TO-INTERNET source TRUSTED destination INTERNET
 service-policy type inspect TRUSTED-TO-INTERNET-POLICY
!
ipv6 access-list TRUSTED-TO-INTERNET-6-ACL
 permit ipv6 any any

And now what is really happening:

moe#sh log
<omitted>
Feb  8 19:15:14.769: %FW-6-DROP_PKT: Dropping tcp session [2A01:<my_laptop's_ipv6>]:61984 [2A00:1450:4009:800::2004]:80 on zone-pair TRUSTED-TO-INTERNET class class-default due to  DROP action found in policy-map with ip ident 0

So from that I think the traffic does not get matched by my policy classes

moe#show policy-map type inspect zone-pair TRUSTED-TO-INTERNET sessions

policy exists on zp TRUSTED-TO-INTERNET
  Zone-pair: TRUSTED-TO-INTERNET

  Service-policy inspect : TRUSTED-TO-INTERNET-POLICY

    Class-map: TRUSTED-TO-INTERNET-CLASS (match-any)
      Match: protocol tcp
        6348 packets, 322834 bytes
        30 second rate 0 bps
      Match: protocol udp
        1890 packets, 100760 bytes
        30 second rate 0 bps
      Match: protocol icmp
        12 packets, 288 bytes
        30 second rate 0 bps

   Inspect

      Number of Established Sessions = 46
      Established Sessions
        Session 2D39D100 (<laptop's_ipv4>:50415)=>(104.199.64.253:4070) tcp SIS_OPEN/TCP_ESTAB
          Created 12:02:12, Last heard 00:00:03
          Bytes sent (initiator:responder) [87580:124570]

< ...
  ...
  omitted
  ...
  ... >


      Number of Half-open Sessions = 3
      Half-open Sessions
        Session 2D3A4B80 [2A01:<laptop_ipv6>]:128=>[2A00:1450:4009:807::200E]:0 icmpv6 SIS_OPENING
          Created 00:20:54, Last heard 00:00:00
          ECHO request
          Bytes sent (initiator:responder) [10008:0]
        Session 2D39CA00 [2A01:<laptop_ipv6>]:55263=>[2A01:578:3::34D7:905B]:443 tcp SIS_OPENING/TCP_SYNSENT
          Created 00:00:28, Last heard 00:00:28
          Bytes sent (initiator:responder) [0:0]
        Session 2D3A4800 [2A01:<laptop_ipv6>]:46727=>[2A01:578:3::3431:3FD0]:443 tcp SIS_OPENING/TCP_SYNSENT
          Created 00:00:19, Last heard 00:00:19
          Bytes sent (initiator:responder) [0:0]


    Class-map: TRUSTED-TO-INTERNET-6-CLASS (match-any)
      Match: protocol tcp
        0 packets, 0 bytes
        30 second rate 0 bps
      Match: protocol udp
        0 packets, 0 bytes
        30 second rate 0 bps
      Match: protocol icmp
        0 packets, 0 bytes
        30 second rate 0 bps
      Match: access-group name TRUSTED-TO-INTERNET-6-ACL
        0 packets, 0 bytes
        30 second rate 0 bps

   Inspect

    Class-map: class-default (match-any)
      Match: any
      Drop
        18961 packets, 961301 bytes

Any ideas why my returning traffic gets shot down by class-default instead of matching as the returning traffic just like it does with ipv4?

Answer 1

ipv6 unicast-routing
ipv6 cef

zone security TRUSTED
zone security INTERNET

ipv6 access-list TRUSTED-TO-INTERNET-6-ACL
 permit ipv6 any any

class-map type inspect match-any TRUSTED-TO-INTERNET-6-CLASS
 match access-group name TRUSTED-TO-INTERNET-6-ACL

policy-map type inspect TRUSTED-TO-INTERNET-POLICY
 class type inspect TRUSTED-TO-INTERNET-6-CLASS
  inspect
 class class-default
  drop log

zone-pair security TRUSTED-TO-INTERNET source TRUSTED destination INTERNET
 service-policy type inspect TRUSTED-TO-INTERNET-POLICY

Please ensure that you have properly associated the correct interfaces with the respective zones (TRUSTED and INTERNET).

Additionally, verify that your IPv6 routing is properly configured on the Cisco 1921 ISR. Make sure the routing table has the necessary routes for the returning IPv6 traffic, and the next-hop interfaces are correctly specified.