The good news is that securing IPv6 FTP is almost
identical to securing IPv4 FTP.
As you've seen in the module,
the TCP/UDP ports and protocol communication patterns are identical.
Sure, IPv6 FTP introduced a few new commands,
but those are application level details.
Just remember key details like how the sessions get originated and
which ports are source versus destination ports.
Perhaps obviously,
the IPv6 addresses will be different than the IPv4
addresses on dual-stacked hosts.
My recommendation is to copy your IPv4 security policy,
replace the IPv4 addresses with IPv6 addresses as required,
then call it your IPv6 FTP security policy.
One caveat to the previous comment about addressing: IPv6 uses ICMPv6
link-local traffic for address resolution on multi-access networks,
such as Ethernet.
You'll want to account for this in your security policy.
I cover this particular topic in great detail in my
ICMP Protocol Deep Dive course, at Pluralsight.
If you do this incorrectly, you'll have a broken network, so watch out.
This is a reference slide,
so feel free to pause the video if you'd like to examine it.
I wanted to provide a simple example of securing FTP active mode
using the IPv6 addresses demonstrated in this course.
The policy will change when using FTP passive mode,
SFTP, or TFTP, as you are well aware by now.
I'm also accounting for the required ICMPv6 neighbor discovery
traffic using a basic ICMPv6 link-local permit.
This entry can be more specific for finer control over ICMPv6 messaging, but that is beyond the scope of an FTP course.