Hi All,
I have been thinking of getting a new “small” router at home to get IPv6 running and working together with my firewall. Currently I’m building the following configuration and need to test it it but it looks promising. Once it is working I will put up a revised version with everything that is required put up here.
update 26-03-2014: revised configuration.
no service pad service timestamps debug datetime msec service timestamps log datetime msec service password-encryption ! hostname <yourhostname> ! ! enable secret <your secret Password> ! no aaa new-model memory-size iomem 10 ! ! ! ! ! ! ! ! no ip domain lookup ip cef ipv6 unicast-routing ipv6 cef ipv6 dhcp pool ipv6_inside dns-server <single ipv6 dns server> ! ! ! ! ! ! controller VDSL 0 ! ! ! ! ! ! ! ! ! ! interface Ethernet0 no ip address ! interface Ethernet0.1 encapsulation dot1Q 6 pppoe enable group global pppoe-client dial-pool-number 1 ! interface ATM0 no ip address shutdown no atm ilmi-keepalive ! interface FastEthernet0 no ip address ! interface FastEthernet1 no ip address ! interface FastEthernet2 no ip address ! interface FastEthernet3 no ip address ! interface Vlan1 ip address <internal IP> <internal subnetmask> ip access-group <ipv4 address list> out ip nat inside ip virtual-reassembly in no autostate ipv6 address <public router ipv6 address> ipv6 enable ipv6 nd other-config-flag ipv6 nd ra interval 30 ipv6 dhcp server ipv6_inside rapid-commit ipv6 mld query-interval 60 ipv6 traffic-filter <ipv6 address list> out ! interface Dialer0 mtu 1492 ip address negotiated ip nat outside ip virtual-reassembly in encapsulation ppp dialer pool 1 dialer idle-timeout 0 dialer-group 1 ipv6 unnumbered vlan1 ipv6 enable ipv6 nd ra interval 30 ipv6 mld query-interval 60 ipv6 virtual-reassembly in ppp authentication pap callin ppp pap sent-username <ppp username> password <ppp password> no cdp enable ! ip forward-protocol nd no ip http server no ip http secure-server ! ip nat inside source list 101 interface Dialer0 overload ip route 0.0.0.0 0.0.0.0 Dialer0 ! ip access-list extended access-list-ipv4 permit tcp any any established permit tcp any host <ASA ipv4 addr> eq 443 permit icmp any any echo-reply permit icmp any any time-exceeded permit icmp any any unreachable permit icmp any any packet-too-big permit icmp any any parameter-problem permit icmp any any echo ! access-list 23 permit <ipv4 allow network / ip for telnet> access-list 101 remark ==== LAN netwerk ==== access-list 101 permit ip <local network> <network address> any dialer-list 1 protocol ip permit no cdp run ipv6 route ::/0 Dialer0 ! ! ipv6 access-list access-list-ipv6 permit ipv6 any FF02::/16 permit ipv6 any FF0E::/16 deny ipv6 any FEC0::/10 deny ipv6 any FF00::/8 permit tcp any any established permit icmp any any echo-reply permit icmp any any time-exceeded permit icmp any any unreachable permit icmp any any echo-request permit icmp any any packet-too-big permit icmp any any parameter-problem permit tcp any host <ASA ipv6 addr> eq 443 remark permit all traffic - make sure you have a correct firewall on the computer permit ip any any ! ipv6 access-list Telnet-netwerk-ipv6 permit ipv6 <allow ipv6 telnet locations> ! ! line con 0 no modem enable line aux 0 line vty 0 4 access-class 23 in password <telnet password> ipv6 access-class Telnet-netwerk-ipv6 in login transport input all !