Several ICMP messages should be allowed to exit the network including echo, parameter problem, packet too big, and source quench. As a rule, block all other ICMP message types outbound.
Attackers can accomplish stealth attacks that result in trust exploitation by using dual-stacked hosts, rogue NDP messages, and tunneling techniques.
To mitigate attacks against IPv6 infrastructures and protocols, the strategy should include filtering at the edge using various techniques, such as IPv6 ACLs.
IPv6 ACLs allow filtering based on source and destination addresses that are traveling inbound and outbound to a specific interface.
They also support traffic filtering based on IPv6 option headers and optional, upper-layer protocol type information for finer granularity of control, similar to extended ACLs in IPv4.
