> Source: [sk102390](https://support.checkpoint.com/results/sk/sk102390)

# sk102390 - IPv6 ICMP traffic is dropped by "0 - Implied Rules"

| Property | Value |
|----------|-------|
| Solution ID | sk102390 |
| Date Created | 2014-09-15 |
| Last Modified | 2016-06-13 |
| Technical Level | Advanced |
| Products | Security Gateway |
| Versions | R82.10, R82, R81.20 |
| OS | Gaia |

## Symptoms

- * IPv6 ICMP traffic (Neighbor Solicitation, Neighbor Advertisement) does not pass through Security Gateway.

* SmartView Tracker logs show (after enabling '`Log Implies Rules`' in the Global Properties in SmartDashboard):

  Protocol = ipv6-icmp

  Action = Drop

  Rule = 0 - Implied Rules

  Information
  * ICMP: Neighbor Solicitation  
    ICMP Type: 135  
    ICMP Code: 0  
    message_info: Implied rule   

  * ICMP: Neighbor Advertisement  
    ICMP Type: 136  
    ICMP Code: 0  
    message_info: Implied rule
* Kernel debug ('`fw ctl debug -m fw + conn vm`') shows that IPv6 ICMP is dropped:

  ```
  
     [-- Stateful VM outbound: Entering (...) --]; 
  ... ...
  ;Before VM: <dir 1, Source_IPv6_Address -> Dest_IPv6_Address IPP 58> (len=...) ICMP protocol=3a, type=88, code=0 ...
  ;fw_get_conn_std_ex: ICMPv6 echo req type=136 id=...344 seq=0 hlen=...;
  ;fw_get_conn_std_ex: ICMPv6 default sport=0 dport=88; 
  ... ...
  ;fw_conn_post_inspect: executing handler function ssh2_code; 
  ;fw_get_conn_std_ex: ICMPv6 echo req type=136 id=... seq=0 hlen=...;
  ;fw_get_conn_std_ex: ICMPv6 default sport=0 dport=88;
  ... ...
  ;fw_conn_post_inspect: handler function returned action DROP;
  ;fw_filter_chain: fw_conn_post_inspect returned action DROP; 
  ;fw_filter_chain: Final switch, action=DROP; 
  ;After  VM: <dir 1, Source_IPv6_Address -> Dest_IPv6_Address IPP 58> (len=...) ICMP protocol=3a, type=88, code=0 ;
  ;VM Final action=DROP;
  ; -----  Stateful VM outbound Completed ----- 
  ```

* Explicit security rule "`Any-Any-Allow`" for IPv6 Neighbor Solicitation / IPv6 Neighbor Advertisements does not help.

* Setting the '`Protocol Type`' in the '`ssh2`' service to '`None`' resolves the issue.

## Cause

IPv6-ICMP traffic (protocol num 58) is dropped by SSH2 inspect code if a security rule contains the service '`ssh2`'.

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content