topic NPTv6 seems bugged (PAN-OS 9.1.9) in General Topics

NPTv6 seems bugged (PAN-OS 9.1.9)

Freaky — Wed, 16 Jun 2021 06:49:25 GMT

Hi,

we're running into an issue with IPv6 NPTv6 which we use to route traffic through IPS on PA.

The address isn't translated as expected.

We tried NPTv6 in 2 configurations, both translate the same. We either used:

xxxx:xxxx:xxxx:ffe0::/60 -> xxxx:xxxx:xxxx:fff0::/60

xxxx:xxxx:xxxx:ffe3::/64 -> xxxx:xxxx:xxxx:fff3::/64

In both cases we sent traffic towards xxxx:xxxx:xxxx:ffe3:83:0:1:0 and it was translated by NPTv6 to xxxx:xxxx:xxxx:fff3:73:0:1:0.

Any ideas? Seems like a nasty bug.

Tried with 2 completely different source IPv6 addresses by the way, both translated the same with the 5th hextet being 0x10 lower than the original.

kiwi — Wed, 16 Jun 2021 09:10:34 GMT

Not sure if this is a confirmed bug.

Have you verified the known issues in the OS release notes ? What's the OS version you're using ?

Cheers,

-Kiwi.

Freaky — Wed, 16 Jun 2021 09:38:36 GMT

Hi,

couldn't find it in the known issues nor in the fixed issues for 9.1.10.

As mentioned in the title it concerns 9.1.9 🙂

Thanks for the re'!

Freaky — Wed, 16 Jun 2021 09:39:26 GMT

We reported this to our PA supplier by the way, don't have access to support myself.

Might take a while to propagate upstream.