topic Re: PAN-OS 12.1, IPv6 and Region/GeoIP in General Topics

PAN-OS 12.1, IPv6 and Region/GeoIP

UffeRBAndersen — Thu, 05 Feb 2026 08:19:09 GMT

Hi,

With PAN-OS 12.1, IPv6 addresses are now also showing what Region they belong to. However, this seems to be limited to logs. Security policies, using specific regions/countries, will still not match the IPv6 addresses, even though the same IPv6 addresses shows the appropriate country code in the logs.

Is this a known issue (internally perhaps)?

Re: PAN-OS 12.1, IPv6 and Region/GeoIP

BPry — Fri, 06 Feb 2026 23:02:20 GMT

@UffeRBAndersen,

There's some caveats to IPv6 geolocation that are suspected that I think you might be running into here. You need to be on a platform with at least 9GBs of memory allocated, if you don't meet that requirement I believe that you'll only get resolution in the logs and not actually see it applied in policy.

Re: PAN-OS 12.1, IPv6 and Region/GeoIP

UffeRBAndersen — Tue, 24 Feb 2026 10:50:01 GMT

Thanks for your answer 👍. I honestly didn't know of such limitation, but according to PAN-OS 12.1 Release Notes, https://docs.paloaltonetworks.com/ngfw/release-notes/12-1/features-introduced-in-pan-os/networking-features, it only apply to PA-410*, PA-415* and small PA-VM's, while I've been testing on a PA-440. The size of the GeoIP mapping for IPv6 would be the same, whether used for logging only or for enforcement as well, so I don't see why a smaller device should be able to use geo location for logging but not for enforcement.

I'll see if I can get a larger VM up and running and perform some testing on that.