IPv6 Drop

To instruct the firewall to drop certain IPv6 packets it receives in the zone, select the following settings to enable them.
Zone Protection Profile Settings—Packet Based Attack Protection
Configured In
Description
Type 0 Routing Heading
NetworkNetwork ProfilesZone ProtectionPacket Based Attack ProtectionIPv6 Drop
Discard IPv6 packets containing a Type 0 routing header. See RFC 5095 for Type 0 routing header information.
IPv4 compatible address
Discard IPv6 packets that are defined as an RFC 4291 IPv4-Compatible IPv6 address.
Anycast source address
Discard IPv6 packets that contain an anycast source address.
Needless fragment header
Discard IPv6 packets with the last fragment flag (M=0) and offset of zero.
MTU in ICMP ‘Packet Too Big’ less than 1280 bytes
Discard IPv6 packets that contain a Packet Too Big ICMPv6 message when the maximum transmission unit (MTU) is less than 1,280 bytes.
Hop-by-Hop extension
Discard IPv6 packets that contain the Hop-by-Hop Options extension header.
Routing extension
Discard IPv6 packets that contain the Routing extension header, which directs packets to one or more intermediate nodes on its way to its destination.
Destination extension
Discard IPv6 packets that contain the Destination Options extension, which contains options intended only for the destination of the packet.
Invalid IPv6 options in extension header
Discard IPv6 packets that contain invalid IPv6 options in an extension header.
Non-zero reserved field
Discard IPv6 packets that have a header with a reserved field not set to zero.

Related Documentation