topic Re: create a any-ipv6 address object in General Topics

create a any-ipv6 address object

mr.linus — Tue, 12 May 2015 09:13:10 GMT

Hey all,

Is it possible to create a any-ipv6 address object?
I tried with an object "::/0" (same syntax used to configure default route) but this seems to hit any-ipv4 address as well.

Tried this in PanOS6.0.10, PanOS6.1.3 and PanOS7.0.0.0b23

Re: create a any-ipv6 address object

aabdelhali — Wed, 13 May 2015 02:35:16 GMT

I believe what you are seeing is expected, basically ::/0 means anything even though there is :: in the beginning. You can verify this by running the command on cli "show running security-policy", and you will see this address is translated to "any".

If you want to use this in security rule, I would recommend to be create a special rule only for IPv6, so IPv4 traffic doesnt hit it.

Amjad

Re: create a any-ipv6 address object

mr.linus — Wed, 13 May 2015 07:20:11 GMT

Dear Amjad,

And how do I create a ipv6 only rule?
That is the question...

Re: create a any-ipv6 address object

mr.linus — Wed, 13 May 2015 12:37:51 GMT

I found a possible "work-around".

Create a ip-range object: 0::0-0:0:0:0:0:0:ffff:ffff -> this will match any ipv4 address (since ipv4 ips can be written as ipv6 ips ex 0:0:0:0:0:0:192.168.1.1) and then NEGATE this object in your rulebase to get all ipv6 addresses.

Re: create a any-ipv6 address object

santonic — Wed, 13 May 2015 13:03:05 GMT

Would all public unicast IPv6 addresses be good for your scenario? 2000::/3

Or you can include private IPv6 addresses as well: fe80::/10