ASA/PIX version > 7.0 support IPv6 although the functionality is still quite limited; in particular, cisco says that if you have your firewall in a failover configuration, it does not work. I tried it out anyway and found that sometimes it works and sometimes it doesn't and that is because both the active and the failover unit send out router advertisment, so you end up with two default gateways. ::/0 fe80::211:21ff:fedf:924a UGDA 1024 21 0 eth0 ::/0 fe80::211:21ff:fedf:923e UGDA 1024 0 0 eth0 If you are lucky and receive the active default gateway first everything works, otherwise you send you packets to the failover unit and they get discarded. To work around this problem remove the wrong entry from your routing table, like this: ip -6 route del ::/0 via fe80::211:21ff:fedf:923e Regards, Biker