I have a PAN on the internet with only IPv4. I have an ASA dual stacked that I want to send IPv6 traffic from hosts connected behind the PAN to the ASA via the LAN. All the interfaces on the PAN in the path have IPv6 configured. However, when the pan receives IPv6 packets that need to route it simply sends it out the UnTrust zone vs the Trust zone where my default and other static IPv6 routes reside. Note IPv4 is working fine and I can ping the Lab interfaces from the host behind the PAN and so forth, its just any IPv6 traffic that needs to be routed past (or through) these PANs that gets punted to the UnTrust zone and I can't figure out why. Its like its not even looking at the IPv6 route table. Next hop of IPv6 edge gateway ASA: 2403:8600:80CF:E100:2000::3 PAN Trust interface: 2403:8600:80CF:E100:2000::5/68 PAN Lab interface: 2403:8600:80cf:e101:2000::1/68 PAN Lab next hop: 2403:8600:80cf:e101:2000::2/68 PAN Lab CIDR: 2403:8600:80cf:e10c:3780::/73 PAN Lab host: 2403:8600:80CF:E10C:3710::10 Eth1/1 is my Trust interface and Eth1/15 is my Lab interface IPv6 route table is below: I have policies allowing all the traffic but it seems like anything it doesn't have a specific IPv6 route for it sends it to the Untrust zone even though the default route is pointing out eth1/1 to 2403:8600:80CF:E100:2000::3. Why would the PAN still try to send the traffic out the UnTrust interface at this point? In the logs below you can see a ping from the ASA (.3) gets punted to UnTrust. But a ping from the PAN itself (.1) routes within that zone without issue all to the same host 2403:8600:80CF:E10C:3710::10. No matter what I do I cannot get the PAN to route all IPv6 traffic to the trust or lab zones, none of it should be going to untrust as there is no IPv6 configured on that zone/interface.
... View more