IPv6 Neighbor Discovery

Neighbor discovery works over the ICMPv6 Neighbor Discovery protocol, which is the functional equivalent of the IPv4 ARP protocol. ICMPv6 Neighbor Discovery Protocol must be explicitly permitted in the Access Control Rule Base for all bridged networks. This is different from ARP. ARP traffic is Layer 2 only, therefore it permitted regardless of the Rule Base.

This is an example of an explicit Rule Base that permits ICMPv6 Neighbor Discovery protocol:

Managing Ethernet Protocols

This feature is supported in R77.10 and higher.

It is possible to configure a Security Gateway with bridge interface to allow or drop protocols that are not based on IP that pass through the bridge interface. For example, protocols that are not IPv4, IPv6, or ARP.

By default, these protocols are allowed by the Security Gateway.

To manage the traffic of Ethernet protocols:

1. On the Security Gateway: Change the value of the global parameter fwaccept_unknown_protocol in $FWDIR/boot/modules/fwkern.conf. The default value is 1.
2. On the Security Management Server: Create user defined tables in the applicable user.def file (see sk98239).

   Example:

   $ifndef __user_def__ $define __user_def__   \\ \\ User defined INSPECT code \\   allowed_ethernet_protocols={ <0x44,0x44> ); dropped_ethernet_protocols={ <0x4,0x4> );     endif /*__user_def__*/

3. In SmartConsole: Install the Access Control Policy.

Traffic is allowed if:

• On the Security Gateway, the value of the kernel parameter fwaccept_unknown_protocol is 1
• OR in the user.def file, protocol is in the allowed_ethernet_protocols table
• AND in the user.def file, protocol is NOT in the dropped_ethernet_protocols table