8

Facebook is very clever with their IPv6 address scheme, but it got me thinking about ACLs and Is it possible to write a Cisco IOS IPv6 ACL that matches ? In IPv4 you could match a middle octet such as 10.xxx.10.xxx in order to hit any 'x' with 'don't care'. I don't think this is possible in IPv6, at least not as of IOS 15.1.

In the case of my example, since Facebook has been clever, it makes it easy to just match on FACE:B00C if you could. In a way this simplifies because without looking up what block was assigned, I can just match on that range.

2A03:2880:F000:[0000-FFFF]:FACE:B00C::/96

The obvious and normal way is to match on 2A03:2880:F000::/48 but unfortunately, I'm not sure at a glance if FB has a larger range ( probably does ). So in this particular case, if I could match on just the FACE:B00C part, I could match everything they are using, assuming they don't move on to FACE:B00D

Since I can't enter a wildcard mask in IOS for and IPv6 ACL, I don't think you can do this, but I'm curious if someone has an interesting workaround. I think it would be useful to know this because at some point I may need to filter a sub block only because of DDoS or aggressive traffic while not wanting to block an entire /32 for some large provider.

Additionally, this could allow for policy based traffic redirection or prioritization. If I realize the advertisements are in a different block, I could QoS them differently for example, a nice feature for low bandwidth, congested satellite links.

EDIT: To clarify a bit. There may be cases where I need to block or permit certain ranges within a large block like a /32. These may be slightly contiguous and rather than hundreds of entries, a wildcard might match large portions of them. This could also be used for traffic engineering in the way I could route all 10.x.10.0 blocks where if x is odd, it goes one route vs even to another route.

Another example is a DDoS where the IPv6 source IP is being spoof with a pattern that spells the hackers' group name. This will happen at least once, it would be nice to be able to filter on it.

A compact ACL is cleaner but not always more manageable. These things may be good or bad ideas/practice, not here to argue that, just trying to get a handle on what tools I have vs what tools I may have to create.

  • Please help us understand how you would use the ACLs if you got them. Is this for security? If so, are there firewalls you could offload this to? What kind of firewall? – Mike Pennington Jan 20 '14 at 15:30
  • Don't bother. If you're looking for Facebook, just match their prefixes and be done with it. I recently saw one which was ...:face:b00c:0:1 which your approach will not pick up. – Michael Hampton Jan 20 '14 at 18:53
  • If you want to block ranges, use subnets. If it is more than a /48 use /47, /46... etc. I'm not sure what you would accomplish with "wildcard" matching in this scenario. Can you perhaps clarify a bit more? – Sebastian Wiesinger Jan 21 '14 at 8:08
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin Aug 8 '17 at 15:59
6

Unfortunately, Cisco did away with wildcard masks in IPv6. That is mostly a good thing, EXCEPT in this particular case. For your idea to work however, you have to rely on Facebook being both "clever" and consistent, which is probably more than one can hope for.

But if you want to process Facebook's traffic differently than other traffic, you can simply filter on their assigned address block. The one you mention in your question is actually assigned to Facebook Ireland: 2a03:2880::/32.

But it is just as easy to look up others in the registries.

  • Amusing, because that's the block at Facebook I'm connecting to from my lab in Florida. GeoIP is another rant. Yes, fine, accept/filter/block the whole /32. The conceptual reason I'm asking is more practical, where an ISP assigns a series of blocks that are being abusive. I want to block, but I can't block the whole /32 only specific /48s or /64s. The use of FACE:B00C is an easy illustrative example, but it could equally be 2001:2880:0100-0FF0:FACE:B00C I want to block. It's not going to be a common filter, but I'd like to always accept :C0FF:EE: – John Spade - 'DaSpadeR' Jan 21 '14 at 2:56
  • 1
    @JohnSpade-'DaSpadeR' A /32 is big enough that you can break it down into very many subnets and route them worldwide. That's as many subnets as IPv4 IP addresses! The whois record is almost irrelevant at that point. And geolocation isn't very good for IPv6 addresses yet. – Michael Hampton Jan 21 '14 at 15:30
5

I was doing some playing with FPM and I think it may do what you're looking for:

load protocol system:fpm/phdf/ether.phdf
load protocol flash:/fpm/phdf/ipv6.phdf
!
class-map type stack match-all cm-ipv6
 match field ETHER type eq 0x86DD next IPV6
class-map type access-control match-all cm-ipv6-facebook
 match start IPV6 dest-addr offset 9 size 4 eq 0xFACEB00C
!
policy-map type access-control pm-ipv6-facebook
 class cm-ipv6-facebook
   drop
policy-map type access-control pm-filter
 class cm-ipv6
   log
  service-policy pm-ipv6-facebook
!
interface FastEthernet0/1
 service-policy type access-control input pm-filter

I had to roll my own ipv6.phdf file for this one:

<?xml version="1.0" encoding="UTF-8"?>
<phdf>
 <version>1</version>
 <protocol name="ipv6" description="Definition-for-the-IPv6-protocol">
 <field name="version" description="IP version">
  <offset type="fixed-offset" units="bits">0</offset>
  <length type="fixed" units="bits">4</length>
 </field>
 <field name="tc" description="IPv6-Traffic-Class">
  <offset type="fixed-offset" units="bits">4</offset>
  <length type="fixed" units="bits">8</length>
 </field>
  <field name="fl" description="IPv6-Flow-Label">
  <offset type="fixed-offset" units="bits">12</offset>
  <length type="fixed" units="bits">20</length>
 </field>
 <field name="length" description="IPv6-Payload-Length">
  <offset type="fixed-offset" units="bits">32</offset>
  <length type="fixed" units="bits">16</length>
 </field>
 <field name="nh" description="IPv6-Next-Header">
  <offset type="fixed-offset" units="bits">48</offset>
  <length type="fixed" units="bits">8</length>
 </field>
 <field name="hl" description="IPv6-Hop-Limit">
  <offset type="fixed-offset" units="bits">56</offset>
  <length type="fixed" units="bits">8</length>
 </field>
 <field name="source-addr" description="IPv6-Source-Address">
  <offset type="fixed-offset" units="bits">64</offset>
  <length type="fixed" units="bits">128</length>
 </field>
 <field name="dest-addr" description="IPv6-Destination-Address">
  <offset type="fixed-offset" units="bits">192</offset>
  <length type="fixed" units="bits">128</length>
 </field>
 <field name="payload-start" description="IPv6-Payload-Start">
  <offset type="fixed-offset" units="bits">320</offset>
  <length type="fixed" units="bits">0</length>
 </field>
 <headerlength type="fixed" value="320"></headerlength>
 <constraint field="version" value="6" operator="eq"></constraint>
</protocol>
</phdf>

Unfortunately, when I do a "show policy-map type access-control interface fa0/1", I get no matches on the ethertype:

FastEthernet0/1 

  Service-policy access-control input: pm-filter

    Class-map: cm-ipv6 (match-all)
      0 packets, 0 bytes
      5 minute offered rate 0 bps, drop rate 0 bps
      Match: field ETHER type eq 0x86DD next IPV6
      log

      Service-policy access-control : pm-ipv6-facebook

        Class-map: cm-ipv6-facebook (match-all)
          0 packets, 0 bytes
          5 minute offered rate 0 bps
          Match: start IPV6 dest-addr offset 9 size 4 eq 0xFACEB00C
      drop

        Class-map: class-default (match-any)
          0 packets, 0 bytes
          5 minute offered rate 0 bps, drop rate 0 bps
          Match: any 

    Class-map: class-default (match-any)
      10000 packets, 1863618 bytes
      5 minute offered rate 14000 bps, drop rate 0 bps
      Match: any 

I suspect that my pings to Facebook's IPv6 address aren't running through CEF properly (the FPM FAQ says it is required) or I'm missing something. Still, I'm putting this out for anyone who wants to chew on it.

  • Hi Jody, +1 for a creative answer. Cisco IOS handles pings to and from the router at the process-level (i.e. not CEF-switched)... perhaps it's worth adding another host behind the router to prove the solution. – Mike Pennington Jan 26 '14 at 13:34
  • Hey Mike. Good point. I was doing all my ping tests from my Mac to Facebook, so while it may still be a process-switching problem, it's not because it originated or terminated at the router. Still trying to figure this one out. Interesting thing is that I'm not even getting a match on the parent policy's 0x86dd ethertype. – Jody Lemoine Jan 26 '14 at 13:39
  • If they don't originate / terminate on the router, they should be cef switched, as long as ipv6 cef is enabled. – Mike Pennington Jan 26 '14 at 13:56
  • IPv6 CEF is definitely on, so I think we're good there. Really wondering why there's no match on the ethertype. – Jody Lemoine Jan 26 '14 at 16:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.