topic ipv6 interface in General Topics

ipv6 interface

LoopSupport — Sun, 23 Jan 2011 22:19:12 GMT

Hi,

I can't assign an IPv6 address to a L3 interface of a PA-500 in 3.1.

But I can add IPv6 addresses to the objects DB, and there is a 'IPv6 firewalling' flag in the general device configuration.

Has anyone played with IPv6 on a PA? Is there any limitation?

Thanks

Re: ipv6 interface

James — Sun, 23 Jan 2011 22:22:39 GMT

Hi There,

IPv6 is currently supported in VWire only

PAN-OS 4.0 introduces L3 support

Thanks

James

Re: ipv6 interface

ncampagna — Mon, 24 Jan 2011 18:20:25 GMT

If you are running virtual wire, the firewall will forward IPv6 traffic by default. If you enable the global IPv6 firewalling setting, then the firewall will also inspect that traffic and apply firewall rules.

To address your question of IPv6 limitations, in general, there is one significant one (which we're addressing in the next release):

1. IPv6 is supported only on VWire interfaces with 3.1 (as James mentioned)

Some likely concerns have been addressed already in previous releases:

1. Content-ID and App-ID will be used to process IPv6 traffic if the IPv6 firewalling setting is configured.

2. IPv6 sessions will be synched in HA

3. URL filtering works on IPv6 content

4. The management interface can be accessed using an IPv6 address

Thanks,

Nick

Re: ipv6 interface

gmoerschel — Tue, 12 Apr 2011 13:54:29 GMT

ncampagna says that "Content-ID and App-ID will be used to process IPv6 traffic if the IPv6 firewalling setting is configured." That's fine but if the app is "Teredo" (IPv6 within IPv4 udp/3544), will a PAN 3.1x box treat Teredo as IPv4 traffic and dig into the packet past the embedded (tunneled) IPv6 header to see if there is malware or a disallowed app within the payload of the tunneled frame?

Re: ipv6 interface

RNC — Wed, 13 Apr 2011 22:40:45 GMT

To which one could add 6to4 and ISATAP. In general, what support is there for IPv6 transition methods (and unpicking the traffic within them)? Is there a roadmap?

Re: ipv6 interface

ncampagna — Fri, 15 Apr 2011 03:15:37 GMT

Hello RNC and gmoerschel,

PAN-OS is able to identify and block IPv6 traffic tunneled within IP packets with the App-IDs you've mentioned. We don't currently decapsulate this tunneled traffic and apply security policy to the inner payload. At this time I don't have a timeframe I can provide for this capability.

Thanks,

Nick Campagna