This article explains how to configure a Cisco ASA for protocol-41.
Prerequisites for this article:
- IOS 7.2(4) not working (asa724-k8.bin) (asdm-524.bin)
- IOS 8.0(2) not working (asa802-k8.bin) (asdm-625.bin)
- IOS 8.3(1) working (asa831-k8.bin) (asdm-631.bin)
- IOS 8.4(1) working (asa841-k8.bin) (asdm-641.bin)
- A working internal tunnel end-point running IPv6-IPv4 tunnel software. I have used an linux server running Debian GNU/Linux 5.0 with the aiccu package. If you want to use a subnet, you also need the radvd package.
- SSH access to the ASA.
Configuration setup I used:
- IP address of the internal Debian machine is 192.168.35.18
- I am using the outside interface of the ASA for translation, I only have one public IP.
Define a new protocol object group
conf t object-group protocol IPv6inIPv4 protocol-object 41 end wr mem
Define the internal linux Debian host
conf t object network IPv6_HOST host 192.168.35.18 end wr mem
Define the POP that you are using
conf t object network IPv6_POP host 22.214.171.124 end wr mem
With the new version of IOS 8.3, configuring a NAT rule has changed. You are now able to NAT specific source and destination traffic, this is what we need to make the IPv6-IPv4 tunnel to work and to let protocol 41 flow trough the ASA. Make sure this line is the first one in you NAT configuration, it should be on top of the rest! (Add NAT Rule Before "Network Object" NAT Rules...)
conf t object network IPv6_HOST nat (inside,outside) source static IPv6_HOST interface destination static IPv6_POP IPv6_POP end wr mem
Open up you're firewall and let protocol 41 flow between the internal Debian host and the POP. I have put these lines at position one, the first line on the interface.
conf t access-list inside_access_in extended permit object-group IPv6inIPv4 object IPv6_HOST object IPv6_POP access-list outside_access_in extended permit object-group IPv6inIPv4 object IPv6_POP object IPv6_HOST end wr mem
Now you should be able to configure the tunnel on the Debian box or any other machine on which you are planning the tunnel end-point.