Good Morning guys,
I have an asa 5510 8.2 i have configured IPv4 and this is working fine.
I am now trying to add the IPv6 configuration. We have been assigned a public /48 block which i have chopped up to /112 blocks. (dont want to use the eui-64) i have assigened diffrent subnets to the inside and outside interfaces. i can ping inside hosts from the inside interface and outside hosts from the outside inteface but cannot ping inside host from the outside interface.
First i thought this was a firewall policy but the ping error i get is "NO ROUTE TO HOST" how can the firewall have no route to connected interfaces. I have checked the IPv6 routing table and the routes are there.
Any ideas why i would get this and how this may be fixed.
Using a different subnet prefix-length then /64 can break many functionality in IPv6 (see http://tools.ietf.org/html/rfc5375#section-3 ). And also with /64 you are not restricted to eui-64-addresses. So the first step to fix this is to correct your IPv6-setup.
Thanks for that,
Will try changing it up later today, I thought we were going for less waste and better allocation with ipv6. a whole /64 even for point to point links thants really bad LOL.
Even if you use eui-64 you couln't fill a /64 as it's a 48 bit address with padding and mac addresses are supposed to be "unique" giving us a limit of 281,474,976,710,656 possible nodes not the virtually unlimited number they claim with this "new" protocol. Will they ever learn the lessons?
Anyway rant over.
Again many thanks for your help will let you know if that fixes it.
For point-to-point links, /127 is the recomended prefix-length.
For your existing problem: Can you post your relevant config and routing-table?
>Pinging from the asa exernal interface to internal hosts unsuccessfull (no route to host)
>Pinging from the asa internal interface to internet unsuccessfull (no route to host)
thats normal behaviour for the ASA. You always have to use the interface that is the nearest to your communication-partner.
Ok but from the above why would you say internal host still cant ping to the net.
i really cant see the problem i have looked everywhere to try and solve this. If there is nothing in the config then the only thing i can be left with is faulty asa which i am hesitant to belive considering it is working well with ipv4