IPv6 Network Security
Is Not Optional — It's Different

No NAT = Direct Exposure

IPv4's NAT provided accidental obscurity. IPv6 gives every device a globally routable address — directly reachable from the internet. Without proper firewall policies, internal servers, printers, and IoT devices are exposed.

ICMPv6 Cannot Be Blocked

Unlike IPv4 where ICMP can be blocked at the firewall, ICMPv6 is essential for Neighbor Discovery, Router Advertisements, SLAAC, and Path MTU Discovery. Blocking it breaks connectivity. You must filter selectively.

Extension Header Abuse

IPv6 extension headers can be chained to evade firewalls and IPS that cannot parse the full chain. Fragmentation headers enable deep packet inspection bypass. Documented by NSA and Black Hat research.

Dual-Stack = 2× Attack Surface

Running both IPv4 and IPv6 doubles your attack surface. Most enterprises have mature IPv4 security but no IPv6 policies at all — attackers target the unprotected protocol.

Rogue Router Advertisements

Any device on the LAN can send Router Advertisements and become the default gateway — redirecting all traffic through an attacker's machine. RA Guard is essential but can be bypassed on some switches.

Address Privacy Leaks

SLAAC with EUI-64 embeds the device's MAC address in its IPv6 address — leaking hardware identity across the internet. RFC 7217 stable privacy addresses must be enforced on all endpoints.

Dual-Stack Firewall Hardening

We configure FortiGate's consolidated policy mode with matching IPv4 and IPv6 security profiles — IPS, antivirus, web filtering, application control, and DLP all applied to IPv6 traffic. No security gaps between protocol stacks.

First-Hop Security (FHS)

Deploy RA Guard, DHCPv6 Guard, IPv6 ND Inspection, and Source Guard on access switches. We build binding tables, configure trust boundaries, and test bypass resistance on your specific switch hardware.

ICMPv6 Policy Design

We design granular ICMPv6 filtering policies — permitting essential types (NDP, Router Solicitation, Path MTU Discovery) while blocking abuse vectors (redirect, information queries, oversized packets).

IPv6 Penetration Testing

Our red team tests your IPv6 attack surface — extension header evasion, rogue RA injection, NDP spoofing, DNS enumeration of IPv6 hosts, and dual-stack escape techniques that bypass IPv4-only security controls.

IPv6 Threat Monitoring

24/7 SOC monitoring of IPv6 traffic flows, NDP anomalies, unauthorized Router Advertisements, and IPv6 tunnel detection. We use FortiAnalyzer and FortiSIEM to provide unified IPv4+IPv6 visibility.

Compliance & Documentation

Detailed IPv6 security policy documentation aligned with NSA IPv6 Security Guidance, NIST SP 800-119, and DoT IPv6 transition requirements. Audit-ready artifacts for regulatory compliance.