Skip to content

Document icmpv6 configuration #209

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
jochenehret wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Document icmpv6 configuration #209

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
26 changes: 18 additions & 8 deletions asg.html.md.erb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@ App Security Groups (ASGs) are a collection of egress rules that enable you to s
ports, and IP address ranges where app or task instances send traffic.

ASGs define **allow** rules, and their order of evaluation is unimportant when multiple ASGs apply to the same space or deployment. The platform sets up rules to filter and log outbound network traffic
from app and task instances. ASGs apply to both buildpack-based and Docker-based apps and tasks.
from app and task instances. ASGs apply to both buildpack-based and Docker-based apps and tasks. Since capi-release v1.212.0, IPv6 is supported in ASGs.
Copy link
Member

@ameowlia ameowlia Jul 10, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
from app and task instances. ASGs apply to both buildpack-based and Docker-based apps and tasks. Since capi-release v1.212.0, IPv6 is supported in ASGs.
from app and task instances. ASGs apply to both buildpack-based and Docker-based apps and tasks. Since capi-release v1.212.0, IPv6 is supported in ASGs.

Really? I assume you will also need some cf-networking changes for this to work, which are not merged yet. We should wait until all of the code is released and the docs should references all of the versions of different releases required.

Copy link
Member

@stephanme stephanme Aug 26, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is meanwhile everything merged?

cf-networking-release v3.74.0 mentions IPv6 improvements and I don't see open PRs anymore.


## <a id='staging-running'></a> Staging and running ASGs

Expand Down Expand Up @@ -94,18 +94,18 @@ For more information, see [Managing ASGs with the cf CLI](#procedures).

ASG rules are specified as a JSON array of ASG objects. An ASG object has the following attributes:

| Attribute | Description | Notes |
| --------- | ----------- | ----- |
| `protocol` | `tcp`, `udp`, `icmp`, or `all` | Required |
| Attribute | Description | Notes |
| --------- |-----------------------------------------| ----- |
| `protocol` | `tcp`, `udp`, `icmp`, `icmpv6` or `all` | Required |
<% if vars.platform_code == 'CF' %>
| `destination` | A comma deliminated list of single IP addresses, IP address ranges like `192.0.2.0-192.0.2.50`, or CIDR blocks that can receive traffic | Destination lists became available in capi-release 1.180.0 and can be enabled by setting the `cc.security_groups.enable_comma_delimited_destinations` bosh property to true. |
| `destination` | A comma deliminated list of single IP addresses, IP address ranges like `192.0.2.0-192.0.2.50`, or CIDR blocks that can receive traffic | Destination lists became available in capi-release 1.180.0 and can be enabled by setting the `cc.security_groups.enable_comma_delimited_destinations` bosh property to true. IPv6 addresses, ranges and CIDR blocks are enabled if `cc.enable_ipv6` is true. For `icmp` you can only use IPv4 addresses and for `icmpv6` only IPv6 addresses. |
<% end %>
<% if vars.platform_code == 'PCF' %>
| `destination` | A single IP address, an IP address range like `192.0.2.0-192.0.2.50`, or a CIDR block that can receive traffic | |
<% end %>
| `ports` | A single port, multiple comma-separated ports, or a single range of ports that can receive traffic. Examples: `443`, `80,8080,8081`, `8080-8081` | Only possible if `protocol` is `tcp` or `udp`. |
| `code` | ICMP code | Required when `protocol` is `icmp`. A value of `-1` allows all codes. |
| `type` | ICMP | Required when `protocol` is `icmp`. A value of `-1` allows all types.
| `code` | ICMP code | Required when `protocol` is `icmp` or `icmpv6`. A value of `-1` allows all codes. |
| `type` | ICMP | Required when `protocol` is `icmp` or `icmpv6`. A value of `-1` allows all types.
| `log` | Set to `true` to enable logging. For more information about how to configure system logs to be sent to a syslog drain, see [Using Log Management Services](../devguide/services/log-management.html). | Logging is only supported with protocol type `tcp`. |
| `description` | An optional field for operators managing ASG rules | |

Expand Down Expand Up @@ -160,7 +160,13 @@ following example, which allows ICMP traffic of code `1` and type `0` to all des
"protocol": "icmp",
"destination": "0.0.0.0/0",
"type": 0,
"code": 0
"code": 1
},
{
"protocol": "icmpv6",
"destination": "::/0",
"type": 0,
"code": 1
},
{
"protocol": "tcp",
Expand Down Expand Up @@ -412,6 +418,10 @@ The following is an example `public_networks` ASG:
{
"destination": "192.169.0.0-255.255.255.255",
"protocol": "all"
},
{
"destination": "::/0",
"protocol": "all"
}
]
```
Expand Down