Can I block ICMPv6 at the firewall like many people do with ICMP in IPv4?
Show the answer
Say this first
No. IPv6 depends on ICMPv6. Neighbor Discovery, router discovery and MLD all run over it, so dropping it on an interface breaks the link. Packet Too Big is required for Path MTU Discovery because routers do not fragment, so dropping it in transit creates black holes. Follow RFC 4890: always allow the error messages (types 1, 2, 3 and 4), allow NDP and MLD on the local link, and decide on echo by policy, usually allowed and rate-limited.
Go deeper
What to allow (RFC 4890, simplified)
| Type | Message | Through the firewall | To the firewall itself |
|---|---|---|---|
| 1 | Destination Unreachable | allow | allow |
| 2 | Packet Too Big | allow, always | allow |
| 3 | Time Exceeded | allow (traceroute, loops) | allow |
| 4 | Parameter Problem | allow | allow |
| 128, 129 | Echo request and reply | policy, usually allow and rate-limit | allow, rate-limited |
| 133 to 137 | RS, RA, NS, NA, Redirect | never crosses a router | allow on the link |
| 130 to 132, 143 | MLD | never crosses a router | allow on the link |
The Cisco ACL trap
Every IPv6 ACL on IOS ends with three implicit lines:
permit icmp any any nd-na
permit icmp any any nd-ns
deny ipv6 any anyIf you write your own deny ipv6 any any log at the end, it matches before the implicit permits and kills
neighbor discovery on that interface. Add the NS and NA permits above your deny.
An edge ACL that respects ICMPv6
ipv6 access-list EDGE-IN
permit icmp any any destination-unreachable
permit icmp any any packet-too-big
permit icmp any any time-exceeded
permit icmp any any parameter-problem
permit icmp any any echo-request
permit icmp any any echo-reply
permit icmp any any nd-ns
permit icmp any any nd-na
permit tcp any 2001:db8:acad:100::/64 eq 443
deny ipv6 any any logThey will ask next
Isn't allowing ICMPv6 a reconnaissance risk?
Echo is the only part that helps scanning, and scanning a /64 by ping is hopeless anyway. Rate-limit echo if you want. The error messages carry information the sender needs to work at all.
Why does Packet Too Big get special treatment?
Because without it nothing else fixes the problem. In IPv4 a router could fragment as a fallback; in IPv6 the source must learn the MTU or the connection stalls.
Traps
- Copying an IPv4 "deny icmp any any" habit to IPv6.
- Ending a Cisco IPv6 ACL with an explicit deny and no NS and NA permits above it.