topic Re: Does PA firewall really support 6in4 tunnel? in General Topics

Does PA firewall really support 6in4 tunnel?

yq — Tue, 24 Dec 2013 05:08:40 GMT

I have a free 6in4 tunnel from Hurricane Electric. The tunnel profile inucludes IPv6 Tunnel Endpoints, Routed IPv6 Prefixes and Anycasted IPv6 Caching Nameserver. I used these information to configure a Juniper SSG firewall and it works. I was told by Technical Support Engineer that PA does support 6in4 and it is termed as NAT64. However it needs to configure DNS64 server, which never needed when I configure SSG firewall. I also don't find place to configure the 6in4 tunnel.

Re: Does PA firewall really support 6in4 tunnel?

tasonibare — Tue, 24 Dec 2013 10:05:17 GMT

yq,

If you are asking about IPv6 packets encapsulated in ESP packets (protocol 50), then that is currently supported in Pan-OS 5.0.

For Teredo tunneling, where IPv6 is the data within IPv4 packets, Palo Alto only recognizes this 6in4 tunnel by the protocol 41 value in the IPv4 header. We do not have a decoder for Teredo 6in4 tunnelling yet so we cannot terminate or configure this feature on the PA firewalls.

We simply pass this through the firewall as IPv4 traffic but the application will read ipv6 in the session details.

A feature request (ID #882) has been filed for this to be implemented and you could contact your SE to vote on this as well, for faster fulfilment of the request.

Regards,

tasonibare

Re: Does PA firewall really support 6in4 tunnel?

ikumar — Wed, 25 Dec 2013 02:37:28 GMT

According to the Ipv6 support matrix . It seems that it is supported in 5.0.0.Please find the ipv6 support link.

https://live.paloaltonetworks.com/docs/DOC-2383

Further more , I found a document where it says about the configuration of 6in4 tunnel.

https://live.paloaltonetworks.com/docs/DOC-4097

Let me know if the above information's are incomplete/incorrect. It is supported as per the document.If this is not really supported then the document for Ipv6 support needs to be corrected

Re: Does PA firewall really support 6in4 tunnel?

yq — Wed, 25 Dec 2013 03:47:42 GMT

I clicked https://live.paloaltonetworks.com/docs/DOC-4097, I got You are not authorized to view this.