topic Re: IPv6 Support in General Topics

IPv6 Support

b.williams — Thu, 29 Aug 2019 13:56:41 GMT

Are there any updates as to if/when PAN will support DHCPv6 Client and IPv6 Prefix Delegation? This is preventing a purchase for me. Without the ability to receive an IPv6 address and prefix delegation dynamically on the WAN interface, this is a show stopper.

Re: IPv6 Support

S.Cantwell — Thu, 29 Aug 2019 20:38:48 GMT

Good Afternoon

I am not 100% sure, but can you take a look at this article and see if it describes what you are looking for?

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClKlCAK

Re: IPv6 Support

b.williams — Thu, 29 Aug 2019 20:56:59 GMT

It does not, but thanks for the attempt. The M and O flags provide a way for you to configure how you are going to assign IPv6 addresses to other devices on the network, either via SLAAC or DHCP. You still have to manually assign a static IP to the interface (referenced by looking at the screen shot in the article).

We need to be able to obtain an IPv6 address on the interface dynamically via DHCP. And then more importantly be able to support prefix delegation. With prefix delagation, the provider hands you a delgated prefix over DHCP as well. The firewall needs to be able to receive that and know what to do with it.

With other solutions that support it, there are usually options on the interface configuration that allow you to send an IPv6 prefix hint to indicate the desired prefix size for delegation. That is typically done on the external or WAN interface. Then there are typically options on the interface settings that you would set on your LAN interfaces to tell them to "track" the WAN interface to get their IPv6 addresses / delegated prefixes.

Without support of these two options, PAN is basically incapable of routing IPv6 to/from the internet.

Re: IPv6 Support

tdahle — Wed, 08 Jan 2020 20:46:36 GMT

Had a chat with my SE. It seems that DHCPv6-PD didn't show up in his searching of feature requests. If you need this feature, you should contact your SE and reference the following feature request ID.

FR ID: 13342

Re: IPv6 Support

pkhavkine — Thu, 15 Apr 2021 16:26:41 GMT

Lack of IPv6 DHCP-PD makes these, specially for GlobalProtect, not usable in Amazon AWS. If you have a GP setup in Amazon, it's not possible to run dual stack, and IPv6 traffic just bypasses the GP tunnel.

Re: IPv6 Support

jtmajorx5 — Sun, 20 Nov 2022 13:45:53 GMT

I know this an old thread, but in case you didn't see this, they finally added this feature! I upgraded a couple of days ago and have been running ipv6 ever since.

https://docs.paloaltonetworks.com/pan-os/11-0/pan-os-new-features/networking-features/dhcpv6-client-with-prefix-delegation

Re: IPv6 Support

pkhavkine — Tue, 06 Dec 2022 19:36:04 GMT

It is still not possible to have GlobalProtect in VM-Series in AWS. GP portal or gateway will not attach to interfaces with DHCPv6-PD enabled.