Cisco Firewall :: 3545 IPv6 Tunneling Through IPv4 - Blockage

Would like to learn from you what tools I could use in a Network that provides IPv6 visibility and also completely blocks IPv6 from being tunneled through ipv4 only networks.
 
I have tested this  from Linux running some internal penetration test apps,but specifically running Teredo tunneling in Local LAN that is able to completely bypass security paremeters such as websence filtering servers and be able to accessing internet IPv6 sites, even its equivalent IPv6 address based on its IPv4 PAT address could be pinged from outside..  is like the PIX firewall never existed  - wide opened door .
 
Blocking in outbound and inbound direction udp ports 3545 and 3544 seem to done the trick in dropping IPv6 at the PIX/ASA  from being tunneled out or in.. Is this so ? Realy ? not to fast!! None of our local systems - users PCs or servers have IPv6 stack enabled as a policy, however, in reality this poses a serious thread.
 
For example, Teredo tunneling running in a host inside LAN say by a user who is a hacker can use different  UDP ports from the standard listening udp 3545/3544 ports, host will still be able to tunnel IPv6 through IPv4 again, in this case I want to have  tool or a strategy that can detect this internally beside being blocked at the firewall, I am looking at AIP for our ASAs would this help?  What other tools could I utilized to have some sort of IPv6 awareness in our LAN without having to rung IPv6 that can provide some visibility of this invisible traffic in IPv4 LANs.