Are IPv6 Wildcard Matches in Cisco IOS Possible?

Question

Facebook is very clever with their IPv6 address scheme, but it got me thinking about ACLs and Is it possible to write a Cisco IOS IPv6 ACL that matches ? In IPv4 you could match a middle octet such as 10.xxx.10.xxx in order to hit any 'x' with 'don't care'. I don't think this is possible in IPv6, at least not as of IOS 15.1.

In the case of my example, since Facebook has been clever, it makes it easy to just match on FACE:B00C if you could. In a way this simplifies because without looking up what block was assigned, I can just match on that range.

2A03:2880:F000:[0000-FFFF]:FACE:B00C::/96

The obvious and normal way is to match on 2A03:2880:F000::/48 but unfortunately, I'm not sure at a glance if FB has a larger range ( probably does ). So in this particular case, if I could match on just the FACE:B00C part, I could match everything they are using, assuming they don't move on to FACE:B00D

Since I can't enter a wildcard mask in IOS for and IPv6 ACL, I don't think you can do this, but I'm curious if someone has an interesting workaround. I think it would be useful to know this because at some point I may need to filter a sub block only because of DDoS or aggressive traffic while not wanting to block an entire /32 for some large provider.

Additionally, this could allow for policy based traffic redirection or prioritization. If I realize the advertisements are in a different block, I could QoS them differently for example, a nice feature for low bandwidth, congested satellite links.

EDIT: To clarify a bit. There may be cases where I need to block or permit certain ranges within a large block like a /32. These may be slightly contiguous and rather than hundreds of entries, a wildcard might match large portions of them. This could also be used for traffic engineering in the way I could route all 10.x.10.0 blocks where if x is odd, it goes one route vs even to another route.

Another example is a DDoS where the IPv6 source IP is being spoof with a pattern that spells the hackers' group name. This will happen at least once, it would be nice to be able to filter on it.

A compact ACL is cleaner but not always more manageable. These things may be good or bad ideas/practice, not here to argue that, just trying to get a handle on what tools I have vs what tools I may have to create.

Answer 1

Unfortunately, Cisco did away with wildcard masks in IPv6. That is mostly a good thing, EXCEPT in this particular case. For your idea to work however, you have to rely on Facebook being both "clever" and consistent, which is probably more than one can hope for.

But if you want to process Facebook's traffic differently than other traffic, you can simply filter on their assigned address block. The one you mention in your question is actually assigned to Facebook Ireland: 2a03:2880::/32.

But it is just as easy to look up others in the registries.

Answer 2

I was doing some playing with FPM and I think it may do what you're looking for:

load protocol system:fpm/phdf/ether.phdf
load protocol flash:/fpm/phdf/ipv6.phdf
!
class-map type stack match-all cm-ipv6
 match field ETHER type eq 0x86DD next IPV6
class-map type access-control match-all cm-ipv6-facebook
 match start IPV6 dest-addr offset 9 size 4 eq 0xFACEB00C
!
policy-map type access-control pm-ipv6-facebook
 class cm-ipv6-facebook
   drop
policy-map type access-control pm-filter
 class cm-ipv6
   log
  service-policy pm-ipv6-facebook
!
interface FastEthernet0/1
 service-policy type access-control input pm-filter

I had to roll my own ipv6.phdf file for this one:

<?xml version="1.0" encoding="UTF-8"?>
<phdf>
 <version>1</version>
 <protocol name="ipv6" description="Definition-for-the-IPv6-protocol">
 <field name="version" description="IP version">
  <offset type="fixed-offset" units="bits">0</offset>
  <length type="fixed" units="bits">4</length>
 </field>
 <field name="tc" description="IPv6-Traffic-Class">
  <offset type="fixed-offset" units="bits">4</offset>
  <length type="fixed" units="bits">8</length>
 </field>
  <field name="fl" description="IPv6-Flow-Label">
  <offset type="fixed-offset" units="bits">12</offset>
  <length type="fixed" units="bits">20</length>
 </field>
 <field name="length" description="IPv6-Payload-Length">
  <offset type="fixed-offset" units="bits">32</offset>
  <length type="fixed" units="bits">16</length>
 </field>
 <field name="nh" description="IPv6-Next-Header">
  <offset type="fixed-offset" units="bits">48</offset>
  <length type="fixed" units="bits">8</length>
 </field>
 <field name="hl" description="IPv6-Hop-Limit">
  <offset type="fixed-offset" units="bits">56</offset>
  <length type="fixed" units="bits">8</length>
 </field>
 <field name="source-addr" description="IPv6-Source-Address">
  <offset type="fixed-offset" units="bits">64</offset>
  <length type="fixed" units="bits">128</length>
 </field>
 <field name="dest-addr" description="IPv6-Destination-Address">
  <offset type="fixed-offset" units="bits">192</offset>
  <length type="fixed" units="bits">128</length>
 </field>
 <field name="payload-start" description="IPv6-Payload-Start">
  <offset type="fixed-offset" units="bits">320</offset>
  <length type="fixed" units="bits">0</length>
 </field>
 <headerlength type="fixed" value="320"></headerlength>
 <constraint field="version" value="6" operator="eq"></constraint>
</protocol>
</phdf>

Unfortunately, when I do a "show policy-map type access-control interface fa0/1", I get no matches on the ethertype:

FastEthernet0/1 

  Service-policy access-control input: pm-filter

    Class-map: cm-ipv6 (match-all)
      0 packets, 0 bytes
      5 minute offered rate 0 bps, drop rate 0 bps
      Match: field ETHER type eq 0x86DD next IPV6
      log

      Service-policy access-control : pm-ipv6-facebook

        Class-map: cm-ipv6-facebook (match-all)
          0 packets, 0 bytes
          5 minute offered rate 0 bps
          Match: start IPV6 dest-addr offset 9 size 4 eq 0xFACEB00C
      drop

        Class-map: class-default (match-any)
          0 packets, 0 bytes
          5 minute offered rate 0 bps, drop rate 0 bps
          Match: any 

    Class-map: class-default (match-any)
      10000 packets, 1863618 bytes
      5 minute offered rate 14000 bps, drop rate 0 bps
      Match: any 

I suspect that my pings to Facebook's IPv6 address aren't running through CEF properly (the FPM FAQ says it is required) or I'm missing something. Still, I'm putting this out for anyone who wants to chew on it.